{"id":"CVE-2026-97627","kind":"vulnerability","aliases":["CVE-2026-97627"],"related":[],"title":"Atsumi Electric DVRs: hidden feature lets an admin run OS commands","description":"Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may execute arbitrary OS commands.","summary":"Atsumi Electric ADX-series EX-SDI/network DVRs ship an undocumented maintenance service, reachable over the network, that lets an administrator-level user run arbitrary OS commands (CWE-912). A second one in the same advisory (CVE-2026-100737) allows upgrading to unauthorized firmware. Needs the admin password. Found by NICT/NICTER. CVSS 3.0 7.2, 4.0 8.6.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ADX5004/ADX5008/ADX404/ADX3004/ADX3008/ADX3016/ADX204","fixed":["10.8.237"],"affected":"< 10.8.237","ecosystem":"vendor"},{"name":"ADX1004/ADX1008/ADX2016","fixed":[],"affected":"all versions","ecosystem":"vendor"}],"ecosystems":[],"tags":["atsumi-electric","cwe-912","dvr","infrastructure","iot","self-hosted"],"not_affected_if":["adx5016","auth-required","no-admin-accounts-exposed","no-network-connection"],"how_to_check":"Look up the model and firmware version in the DVR's system info screen. Affected: ADX5004/5008/ADX404/ADX3004/3008/3016/ADX204 with firmware before Ver.10.8.237; ADX1004/1008/ADX2016 on any version. ADX5016 is not affected.","fix":"Upgrade ADX5004/5008/404/3004/3008/3016/204 to firmware Ver.10.8.237 (e.g. ndvr_adx5004_10.8.237.dax, edvr_adx3004_10.8.237.dat; download from the Atsumi notice). ADX1004/1008/2016 are end of sale with no fix: run them with no network connection, or replace them with a current model. Until patched, keep the DVR off the internet and change the admin password.","status":"open","published_at":"2026-10-20T06:16:58+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:39:43+00:00","updated_at":"2026-10-24T00:18:02+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:39:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Atsumi Electric DVRs: hidden feature lets an admin run OS commands","impact":"high","summary":"Several Atsumi Electric digital video recorder models contain a hidden function. A user logged in with administrator rights can use it to run arbitrary operating system commands on the device.","category":"infrastructure","who_cares":["atsumi-electric","dvr","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Admin account gains operating system command execution on the recorder","analyst_note":"Get the affected model list and firmware fix versions from the NVD entry and the vendor (Atsumi Electric) advisory; the sources give no versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-admin-accounts-exposed","auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000459,"input_tokens":2902,"output_tokens":338,"severity_before":"high"},"analyst_status":"done","analyst_note":"Get the affected model list and firmware fix versions from the NVD entry and the vendor (Atsumi Electric) advisory; the sources give no versions.","search":"'-100737':72B '-2026':13A,16A,71B '-912':24B,62B '-97627':14A,17A '/network':39B '3.0':86B '4.0':88B '7.2':87B '8.6':89B 'admin':8A,80B 'administr':54B,117C 'administrator-level':53B 'advisori':69B 'adx':34B 'adx-seri':33B 'adx1004/adx1008/adx2016':19A 'adx5004/adx5008/adx404/adx3004/adx3008/adx3016/adx204':18A 'allow':73B 'arbitrari':58B,121C 'atsumi':1A,21B,31B,102C 'atsumi-electr':20B 'co':104C 'command':11A,60B,123C 'cve':12A,15A,70B 'cvss':85B 'cwe':23B,61B 'digit':97C 'dvr':25B 'dvrs':3A,40B,96C 'electr':2A,22B,32B,103C 'ex':37B 'ex-sdi':36B 'execut':120C 'exist':93C 'featur':5A 'firmwar':77B 'found':82B 'function':91C 'hidden':4A,90C 'host':30B 'infrastructur':26B 'iot':27B 'issu':92C 'let':6A,51B 'level':55B 'log':110C 'ltd':105C 'mainten':44B 'may':119C 'multipl':95C 'need':78B 'network':49B 'nict/nicter':84B 'one':65B 'os':10A,59B,122C 'password':81B 'privileg':118C 'product':114C 'provid':100C 'reachabl':46B 'record':99C 'run':9A,57B 'sdi':38B 'second':64B 'self':29B 'self-host':28B 'seri':35B 'servic':45B 'ship':41B 'unauthor':76B 'undocu':43B 'upgrad':74B 'user':56B,107C 'video':98C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T06:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vultures@jpcert.or.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97627","severity":null,"published_at":"2026-10-20T06:16:58+00:00","modified_at":"2026-10-20T20:17:26+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-97627:631","url":null,"severity":null,"published_at":"2026-10-24T00:18:02+00:00","modified_at":"2026-10-24T00:18:02+00:00","first_seen_at":"2026-10-24T00:18:02+00:00","fetched_at":"2026-10-24T00:18:02+00:00","note":"Read vendor (atsumi.co.jp info-20261005) and JVN#88864366 / CVE record: versions and fixes from those. No exploitation or PoC found; did not search social posts. Sibling CVE-2026-100737 (unauthorized firmware upload) is in the same advisory."}],"documents":[{"id":2535,"url":"https://www.atsumi.co.jp/info-20261005.html","title":"Atsumi Electric: ADX series DVR hidden function vulnerability (2026/10/20)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2537,"url":"https://jvn.jp/en/jp/JVN88864366/","title":"JVN#88864366: Atsumi Electric DVRs contain hidden functionality issues","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}