Atsumi Electric ADX DVRs: Hidden functionality allows OS command execution
Summary
Several Atsumi Electric ADX series DVRs contain a hidden functionality issue (CWE-912 per JVN and the CVE record). An attacker who logs in with administrator privileges can execute arbitrary OS commands on the device. The attack is reachable over the network but requires valid administrator credentials. A related issue, CVE-2026-100737, also lets administrators install unauthorized firmware.
Affected
- ADX5004, ADX5008, ADX404: all versions before Ver.10.8.237
- ADX3004, ADX3008, ADX3016, ADX204: all versions before Ver.10.8.237
- ADX1004, ADX1008, ADX2016: all versions (discontinued)
- According to the vendor, ADX5016 is not affected.
Fixed in
- ADX5004, ADX5008, ADX404, ADX3004, ADX3008, ADX3016, ADX204: Ver.10.8.237 or later (vendor firmware)
- ADX1004, ADX1008, ADX2016: no fix, no firmware update will be provided
Workaround
- The developer recommends operating the products without a network connection.
- For ADX1004, ADX1008 and ADX2016 no fix exists; the vendor advises using a successor product if a network connection is required.
Exploitation
- No known exploitation in the wild.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept detected; not listed in the CISA KEV catalog.
Our recommendation
- Inventory all Atsumi ADX units by model and firmware version.
- Update ADX5004, ADX5008, ADX404, ADX3004, ADX3008, ADX3016 and ADX204 to Ver.10.8.237 or later. After the update, default and weak passwords no longer work, so set new strong passwords.
- Replace ADX1004, ADX1008 and ADX2016 with a supported successor product (the vendor points to the ADX5000 series).
- Until patched, disconnect DVRs from the internet, restrict management access to a trusted LAN or VPN, and review admin accounts.
- Monitor the vendor advisory and NVD for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- JVN#88864366 (English) jvn.jp
- Atsumi Electric product notice www.atsumi.co.jp
- JVNDB-2026-000154 jvndb.jvn.jp
- OpenCVE: CVE-2026-97627 app.opencve.io
- VulDB 422664 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:43.
Original description (NVD)
Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may execute arbitrary OS commands.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.