CVE-2026-97627 Details
Description
Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may execute arbitrary OS commands.
A vulnerability exists in multiple DVR models by Atsumi Electric Co., Ltd., allowing users with administrator privileges to execute arbitrary operating system commands. This issue arises from hidden functionalities intended for maintenance purposes, which can be exploited if an administrator's password is known.
Affected users of the ADX5004, ADX5008, ADX404, ADX3004, ADX3008, ADX3016, and ADX204 models should update to the latest firmware version 10.8.237. Instructions for the upgrade process are available on the Atsumi Electric website. For ADX1004, ADX1008, and ADX2016 models, no firmware updates are available due to the products being discontinued. Users are advised to disconnect the DVR from the network or consider replacing it with a newer model.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 20, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://jvn.jp/en/jp/JVN88864366/ | [email protected] | AdvisoryBundleRemedy |
| https://www.atsumi.co.jp/info-20261005.html | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-912 | Hidden Functionality | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Atsumi Electric ADX5004 | < 10.8.237 (semver) |
CPE
Remediation
| |
| Atsumi Electric ADX5008 | < 10.8.237 (semver) |
CPE
Remediation
| |
| Atsumi Electric ADX404 | < 10.8.237 (semver) |
CPE
Remediation
| |
| Atsumi Electric ADX3004 | < 10.8.237 (semver) |
CPE
Remediation
| |
| Atsumi Electric ADX3008 | < 10.8.237 (semver) |
CPE
Remediation
| |
| Atsumi Electric ADX3016 | < 10.8.237 (semver) |
CPE
Remediation
| |
| Atsumi Electric ADX204 | < 10.8.237 (semver) |
CPE
Remediation
| |
| Atsumi Electric ADX1004 | All versions |
CPE
Remediation
| |
| Atsumi Electric ADX1008 | All versions |
CPE
Remediation
| |
| Atsumi Electric ADX2016 | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 20, 2026 | New CVE Received | [email protected] |