Atsumi Electric DVR CVE-2026-97627

Exploitation requires the attacker to first authenticate to the affected DVR (models ADX5004, ADX5008, ADX404, ADX3004, ADX3008, ADX3016, ADX204, ADX1004, ADX1008, ADX2016) with administrator privilege; this is confirmed by CVSS PR:H. The vulnerable behavior is an undocumented hidden function (CWE-912) in the device that, once reached by an administrator, accepts and runs arbitrary OS commands. The primary limiting factor is therefore the need for valid administrator credentials - risk concentrates where admin passwords are default, weak, reused, or the management interface is exposed to untrusted networks/the internet. No end-user interaction is required (UI:N) and attack complexity is low (AC:L), so there is no additional configuration toggle or timing dependency beyond holding admin access and network reachability to the management interface.

This is a hidden-functionality / backdoor-style flaw (CWE-912) in multiple Atsumi Electric DVR models that permits arbitrary OS command execution. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:H/VI:H/VA:H, score 8.6) is the key and only quantitative signal available: exploitation is network-reachable with low complexity, but critically requires PR:H - an attacker must already hold administrator privileges on the device. There is no EPSS score, no CISA KEV listing, and no public POC in the supplied data, so this is 'no public exploit identified at time of analysis.' The gating factor of administrator authentication substantially lowers real-world risk relative to the 8.6 headline: this is not an unauthenticated internet-wormable issue but rather a privilege-to-code-execution escalation path that matters most where admin credentials are weak, shared, default, or already compromised. The high CVSS impact (full C/I/A on the device) reflects total device takeover once that admin precondition is met. Net assessment: meaningful but conditional risk - prioritize patching for internet-exposed DVRs and those with weak admin credential hygiene, but it is not a drop-everything mass-exploitation event absent any exploitation or EPSS evidence. Note a minor data conflict: the input Tags label this 'Information Disclosure', which contradicts the CWE-912 hidden-functionality / OS-command-execution nature and the full-integrity/availability impact - verify tagging with the source advisory.

An attacker who has obtained administrator access to an Atsumi DVR web/management interface (for example via default, reused, or phished credentials, or an exposed internet-facing panel) invokes the device's undocumented hidden functionality to run arbitrary operating-system commands on the recorder. This yields full control of the DVR, letting the attacker tamper with or disable recorded surveillance footage and pivot into the connected network. No public exploit code is identified in the available data, and exploitation requires low attack complexity once admin login is achieved.