CVE-2026-100737

MediumCVSS 6.9/10Last modified Oct 20, 2026

Description

Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may upgrade the affected product to unauthorized firmware.

Metrics

CVSS 4.0 6.9/10CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-912

Affected software

VendorProductVersions
Atsumi Electric Co., Ltd.ADX5004< Ver.10.8.237
Atsumi Electric Co., Ltd.ADX5008< Ver.10.8.237
Atsumi Electric Co., Ltd.ADX404< Ver.10.8.237
Atsumi Electric Co., Ltd.ADX3004< Ver.10.8.237
Atsumi Electric Co., Ltd.ADX3008< Ver.10.8.237
Atsumi Electric Co., Ltd.ADX3016< Ver.10.8.237
Atsumi Electric Co., Ltd.ADX204< Ver.10.8.237
Atsumi Electric Co., Ltd.ADX1004all versions
Atsumi Electric Co., Ltd.ADX1008all versions
Atsumi Electric Co., Ltd.ADX2016all versions

References

Timeline

Published
Oct 20, 2026
Last modified
Oct 20, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1007397.3A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknCVE-2026-100744.9DreamMaker developed by Interinfo has an Arbitrary File Read vulnerability, allowing privileged local attackers to exploit Relative Path TraCVE-2026-1007409.9A vulnerability was detected in D-Link DIR-895L A1_102b07. Impacted is the function tunnel_set_params of the file tunnel.c of the component CVE-2026-1007419.8Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allowCVE-2026-1007447.3A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdaCVE-2026-1007456.3A vulnerability has been found in Edimax BR-6428nC 1.16. The impacted element is an unknown function of the file /goform/formWizSurvey of thCVE-2026-1007467.3A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/CVE-2026-1007476.5Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due to lack of an CSRF token check, a third-parCVE-2026-1007488.8Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0CVE-2026-1007494.3Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0 - Only orphaned file entries and shoppCVE-2026-100755.3DreamMaker developed by Interinfo has a Path Traversal vulnerability, allowing unauthenticated remote attackers to read file names under arbCVE-2026-1007507.5Joomla Extension - regularlabs.com - LFI / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla - Modules Anywhere Pro lets additional attribut