Read the docs
TI-2026-76717 Aliases CVE-2026-100737GHSA-9p4x-ppr8-mm4w

Hidden functionality in Atsumi DVRs allows unauthorized firmware

Priority LOW 30CWE-912Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Atsumi Electric Co., Ltd. DVRs including ADX5004, ADX5008, ADX404, ADX3004 and other products contain hidden functionality (CWE-912). A remote user who can log in with administrator privilege can upgrade the product to unauthorized firmware.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may upgrade the affected product to unauthorized firmware.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00264 18th percentileScored 2026-11-07
Fix Fixed ADX5004 (Atsumi Electric Co., Ltd.): Ver.10.8.237ADX5008 (Atsumi Electric Co., Ltd.): Ver.10.8.237+5 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Atsumi Electric Co., Ltd.ADX5004before Ver.10.8.237Ver.10.8.237Patch availableCNA
Atsumi Electric Co., Ltd.ADX5008before Ver.10.8.237Ver.10.8.237Patch availableCNA
Atsumi Electric Co., Ltd.ADX404before Ver.10.8.237Ver.10.8.237Patch availableCNA
Atsumi Electric Co., Ltd.ADX3004before Ver.10.8.237Ver.10.8.237Patch availableCNA
Atsumi Electric Co., Ltd.ADX3008before Ver.10.8.237Ver.10.8.237Patch availableCNA
Atsumi Electric Co., Ltd.ADX3016before Ver.10.8.237Ver.10.8.237Patch availableCNA
Atsumi Electric Co., Ltd.ADX204before Ver.10.8.237Ver.10.8.237Patch availableCNA
Atsumi Electric Co., Ltd.ADX1004all versions—No fix listedCNA
Atsumi Electric Co., Ltd.ADX1008all versions—No fix listedCNA
Atsumi Electric Co., Ltd.ADX2016all versions—No fix listedCNA

Remediation

Update ADX5004, ADX5008, ADX404, ADX3004, ADX3008, ADX3016 and ADX204 to Ver.10.8.237. No fixed version is listed for ADX1004, ADX1008 or ADX2016.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA ADX5004 (Atsumi Electric Co., Ltd.) Fixed in Ver.10.8.237
  • Fix · CNA ADX5008 (Atsumi Electric Co., Ltd.) Fixed in Ver.10.8.237
  • Fix · CNA ADX404 (Atsumi Electric Co., Ltd.) Fixed in Ver.10.8.237
  • Fix · CNA ADX3004 (Atsumi Electric Co., Ltd.) Fixed in Ver.10.8.237
  • Fix · CNA ADX3008 (Atsumi Electric Co., Ltd.) Fixed in Ver.10.8.237
  • Fix · CNA ADX3016 (Atsumi Electric Co., Ltd.) Fixed in Ver.10.8.237
  • Fix · CNA ADX204 (Atsumi Electric Co., Ltd.) Fixed in Ver.10.8.237

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Atsumi Electric ADX204, ADX3004 and 5 more products Ver.10.8.237

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-76721 Hidden functionality in Atsumi DVRs allows OS command executionPriority LOW 39
    Show all 2 records →

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-100737
  2. 2026-10-20 Alias added: GHSA-9p4x-ppr8-mm4w
  3. 2026-10-20 CISA SSVC decision points changed
  4. 2026-10-20 Priority changed: MEDIUM → LOW

References

Other 2

  • TI-2026-76721 Hidden functionality in Atsumi DVRs allows OS command execution CVSS 4.0HIGH 8.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences