[Japanese]

JVNDB-2026-000154

Atsumi Electric DVRs contain hidden functionality issues

Overview

Multiple DVRs provided by Atsumi Electric Co., Ltd. contain multiple vulnerabilities listed below:
  • Hidden Functionality (CWE-912) - CVE-2026-97627
  • Hidden Functionality (CWE-912) - CVE-2026-100737
Cyber Threat Analysis Office, Cybersecurity Research Institute, National Institute of Information and Communications Technology (NICT) reported these vulnerabilities to Atsumi Electric Co., Ltd. and coordinated. After the coordination was completed, NICTER Analysis Team reported the case to JPCERT/CC to notify users of the solution through JVN.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 7.2 (High) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
CVSS v4 Severity
Base Metrics: 8.6 (High) [IPA Score]
  • Access Vector (AV): Network
  • Attack Complexity (AC): Low
  • Attack Requirements (AT): None
  • Privileges Required (PR): High
  • User Interaction (UI): None
    • Vulnerable System Impact
  • Confidentiality Impact (VC): High
  • Integrity Impact (VI): High
  • Availability Impact (VA): High
    • Subsequent System Impact
  • Confidentiality Impact (SC): None
  • Integrity Impact (SI): None
  • Availability Impact (SA): None
The above CVSS base scores have been assigned for CVE-2026-97627

CVSS v3 Severity
Base Metrics: 4.9(Medium) [IPA Score]
  • Access Vector : Network
  • Attack Complexity : Low
  • Privileges Required : High
  • User Interaction : None
  • Scope : Unchanged
  • Confidentiality Impact : None
  • Integrity Impact : High
  • Availability Impact : None
CVSS v4 Severity
Base Metrics: 6.9 (Medium) [IPA Score]
  • Access Vector (AV): Network
  • Attack Complexity (AC): Low
  • Attack Requirements (AT): None
  • Privileges Required (PR): High
  • User Interaction (UI): None
    • Vulnerable System Impact
  • Confidentiality Impact (VC): None
  • Integrity Impact (VI): High
  • Availability Impact (VA): None
    • Subsequent System Impact
  • Confidentiality Impact (SC): None
  • Integrity Impact (SI): None
  • Availability Impact (SA): None
The above CVSS base scores have been assigned for CVE-2026-100737
Affected Products


ATSUMI Electric co.,Ltd.
  • ADX1004 all versions
  • ADX1008 all versions
  • ADX2016 all versions
  • ADX204 versions prior to Ver.10.8.237
  • ADX3004 versions prior to Ver.10.8.237
  • ADX3008 versions prior to Ver.10.8.237
  • ADX3016 versions prior to Ver.10.8.237
  • ADX404 versions prior to Ver.10.8.237
  • ADX5004 versions prior to Ver.10.8.237
  • ADX5008 versions prior to Ver.10.8.237

Impact

  • A user who can log in to the product with the administrator privilege may execute arbitrary OS commands (CVE-2026-97627).
  • A user who can log in to the product with the administrator privilege may upgrade the affected product to unauthorized firmware (CVE-2026-100737).
Solution

For ADX5004/ADX5008/ADX404/ADX3004/ADX3008/ADX3016/ADX204:
[Update the firmware]
Update the firmware to the latest version according to the information provided by the developer.

For ADX1004/ADX1008/ADX2016:
As several years have passed since the products were discontinued, no firmware update will be provided.
[Apply the Workaround]
The developer recommends using the producs without a network connection.
[Stop using the products]
If the product needs to be used with a network connection, consider using a successor product.
Vendor Information

ATSUMI Electric co.,Ltd.
CWE (What is CWE?)

  1. No Mapping(CWE-Other) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2026-97627
  2. CVE-2026-100737
References

  1. JVN : JVN#88864366
Revision History

  • [2026/10/20]
      Web page was published

Date Public2026/10/20
Date First Published2026/10/20
Date Last Updated2026/10/20