Read the docs
TI-2026-76721 Aliases CVE-2026-97627GHSA-wvwj-r2jm-h52q

Hidden functionality in Atsumi DVRs allows OS command execution

Priority LOW 39CWE-912Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Multiple Atsumi Electric Co., Ltd. DVR models, including ADX5004, ADX5008, ADX404, ADX3004 and other models, contain hidden functionality (CWE-912). A user logged in with administrator privilege can execute arbitrary OS commands. The attack needs network access and high privileges, and no user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may execute arbitrary OS commands.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00377 31st percentileScored 2026-11-07
Fix Fixed ADX5004 (Atsumi Electric Co., Ltd.): Ver.10.8.237ADX5008 (Atsumi Electric Co., Ltd.): Ver.10.8.237+5 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Atsumi Electric Co., Ltd.ADX5004before Ver.10.8.237Ver.10.8.237Patch availableCNA
Atsumi Electric Co., Ltd.ADX5008before Ver.10.8.237Ver.10.8.237Patch availableCNA
Atsumi Electric Co., Ltd.ADX404before Ver.10.8.237Ver.10.8.237Patch availableCNA
Atsumi Electric Co., Ltd.ADX3004before Ver.10.8.237Ver.10.8.237Patch availableCNA
Atsumi Electric Co., Ltd.ADX3008before Ver.10.8.237Ver.10.8.237Patch availableCNA
Atsumi Electric Co., Ltd.ADX3016before Ver.10.8.237Ver.10.8.237Patch availableCNA
Atsumi Electric Co., Ltd.ADX204before Ver.10.8.237Ver.10.8.237Patch availableCNA
Atsumi Electric Co., Ltd.ADX1004all versions—No fix listedCNA
Atsumi Electric Co., Ltd.ADX1008all versions—No fix listedCNA
Atsumi Electric Co., Ltd.ADX2016all versions—No fix listedCNA

Remediation

Update ADX5004, ADX5008, ADX404, ADX3004, ADX3008, ADX3016 and ADX204 to Ver.10.8.237. No fixed version is listed for ADX1004, ADX1008 or ADX2016.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA ADX5004 (Atsumi Electric Co., Ltd.) Fixed in Ver.10.8.237
  • Fix · CNA ADX5008 (Atsumi Electric Co., Ltd.) Fixed in Ver.10.8.237
  • Fix · CNA ADX404 (Atsumi Electric Co., Ltd.) Fixed in Ver.10.8.237
  • Fix · CNA ADX3004 (Atsumi Electric Co., Ltd.) Fixed in Ver.10.8.237
  • Fix · CNA ADX3008 (Atsumi Electric Co., Ltd.) Fixed in Ver.10.8.237
  • Fix · CNA ADX3016 (Atsumi Electric Co., Ltd.) Fixed in Ver.10.8.237
  • Fix · CNA ADX204 (Atsumi Electric Co., Ltd.) Fixed in Ver.10.8.237

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Atsumi Electric ADX204, ADX3004 and 5 more products Ver.10.8.237

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-76717 Hidden functionality in Atsumi DVRs allows unauthorized firmwarePriority LOW 30
    Show all 2 records →

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-97627
  2. 2026-10-20 Alias added: GHSA-wvwj-r2jm-h52q
  3. 2026-10-20 CISA SSVC decision points changed
  4. 2026-10-20 Priority changed: MEDIUM → LOW

References

Other 2

  • TI-2026-76717 Hidden functionality in Atsumi DVRs allows unauthorized firmware CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences