Adx3008
Monthly
Arbitrary OS command execution in multiple Atsumi Electric DVR models (ADX1004, ADX1008, ADX204, ADX404, ADX3004, ADX3008, ADX3016, ADX5004, ADX5008 and ADX2016) is enabled by an undocumented hidden function reachable by an administrator-level user, with high confidentiality, integrity and availability impact (CVSS 8.6 CVSS 4.0; assessed CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation requires valid administrator credentials (PR:H) and network reachability to the management interface, but no user interaction and low attack complexity; no public exploit code or CISA KEV entry was identified at time of analysis. Risk is concentrated where admin passwords are default, weak or reused, or where the DVR management interface is exposed to untrusted networks.
Atsumi Electric ADX-series DVRs expose hidden firmware-upgrade functionality that lets an authenticated administrator load unauthorized firmware, compromising device integrity while leaving confidentiality and availability unaffected. The issue affects ADX5004, ADX5008, ADX404, ADX3004, ADX3008, ADX3016, ADX204, ADX1004, ADX1008, and ADX2016 devices and requires a valid administrator login over the network (CVSS 4.9). No public exploit was identified at time of analysis, and the main risk is exposure of weakly protected or internet-facing management interfaces.
Arbitrary OS command execution in multiple Atsumi Electric DVR models (ADX1004, ADX1008, ADX204, ADX404, ADX3004, ADX3008, ADX3016, ADX5004, ADX5008 and ADX2016) is enabled by an undocumented hidden function reachable by an administrator-level user, with high confidentiality, integrity and availability impact (CVSS 8.6 CVSS 4.0; assessed CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation requires valid administrator credentials (PR:H) and network reachability to the management interface, but no user interaction and low attack complexity; no public exploit code or CISA KEV entry was identified at time of analysis. Risk is concentrated where admin passwords are default, weak or reused, or where the DVR management interface is exposed to untrusted networks.
Atsumi Electric ADX-series DVRs expose hidden firmware-upgrade functionality that lets an authenticated administrator load unauthorized firmware, compromising device integrity while leaving confidentiality and availability unaffected. The issue affects ADX5004, ADX5008, ADX404, ADX3004, ADX3008, ADX3016, ADX204, ADX1004, ADX1008, and ADX2016 devices and requires a valid administrator login over the network (CVSS 4.9). No public exploit was identified at time of analysis, and the main risk is exposure of weakly protected or internet-facing management interfaces.