Atsumi ADX DVRs EUVD-2026-104797

Exploitation requires the attacker to first be logged in to the DVR with administrator privilege (PR:H); the specific prerequisite named in the description is possession of a valid administrator account on an affected ADX-series device (ADX5004, ADX5008, ADX404, ADX3004, ADX3008, ADX3016, ADX204, ADX1004, ADX1008, ADX2016). The abused mechanism is an undocumented/hidden firmware-upgrade function reachable over the network (AV:N) once authenticated, with low attack complexity (AC:L) and no user interaction (UI:N). The key limiting factor is the administrator authentication gate - the flaw is not reachable by unauthenticated or lower-privileged users - so realistic risk is highest where admin credentials are weak, default, shared, or where the management interface is exposed to untrusted networks.

This is a moderate-severity, low-urgency issue rather than a top priority. The vendor CVSS 3.0 vector (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N, 4.9) requires administrator privileges (PR:H), which is the dominant limiting factor: an attacker must already be authenticated as an administrator before the hidden firmware-upgrade functionality (CWE-912) can be abused, so this is a post-compromise integrity risk, not an unauthenticated remote takeover. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so exploitation probability and automatability cannot be quantified; the absence of these signals is not itself evidence of safety but does mean there is no indication of active or widespread exploitation at this time. Impact is confined to integrity (I:H, loading unauthorized/malicious firmware) with no direct confidentiality or availability impact in the scored vector, though unauthorized firmware could in practice undermine all three. Net: treat as a standard-priority patch for affected Atsumi DVR operators, disproportionately important only where admin credentials may be shared, weak, or reachable from untrusted networks.

An attacker who has obtained administrator credentials for an affected Atsumi Electric DVR (via phishing, credential reuse, default/weak passwords, or an exposed management interface) logs into the device over the network and invokes the undocumented firmware-upgrade capability to flash unauthorized firmware, establishing a persistent, hard-to-detect foothold on the surveillance device. No public exploit code was identified in the provided data, and exploitation is gated on first achieving administrator access.