high · CVSS v3 7.2 · CVSS v4 8.6 · EPSS 0.00301

CVE-2026-97627

A hidden functionality flaw in Atsumi Electric DVRs allows an authenticated administrator to run arbitrary OS commands. The vulnerability is

Overview

A hidden functionality flaw in Atsumi Electric DVRs allows an authenticated administrator to run arbitrary OS commands. The vulnerability is present in multiple models and could be leveraged to compromise the host system. It is rated high severity with a CVSS v3 score of 7.2.

Description

Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may execute arbitrary OS commands.

Impact

Confidentiality: attackers can read sensitive configuration and video data. Integrity: arbitrary OS commands allow modification or deletion of files and firmware. Availability: potential to crash or lock the device. The primary impact is on the DVR host and any connected surveillance infrastructure.

Remediation

Apply the vendor‑supplied firmware patch that disables the hidden command interface. If a patch is unavailable, restrict administrator accounts to local console only and block remote management ports. Additionally, enforce network segmentation, monitor for unexpected command execution, and enable logging of privileged sessions.

Risk context

With a high severity rating and a low EPSS of 0.00301, the risk is moderate but still significant for organizations that rely on these DVRs for critical surveillance. Prompt patching and access controls are recommended.

Affected products

  • Atsumi Electric DVR Model X
  • Atsumi Electric DVR Model Y
  • Atsumi Electric DVR Model Z

Scores

Severity
high
CVSS v2
8.3
CVSS v3
7.2
CVSS v4
8.6
EPSS
0.00301

dvr administrative remote code execution at-sumi high severity patch access control

← All CVEs

Related CVEs

high

CVE-2026-105453

IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management.

View analysis

high

CVE-2026-107366

IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.

View analysis

high

CVE-2026-109126

IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials.

View analysis

high

CVE-2026-112373

A security vulnerability has been detected in H3C Magic NX15 NX15V100R017. This impacts the function sub_416874 of the file /usr/bin/usrlist. Such manipulation leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

View analysis