CVE-2026-100737

MediumCVSS 6.9/10Last modified Oct 20, 2026

Description

Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may upgrade the affected product to unauthorized firmware.

Metrics

CVSS 4.0 6.9/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-912

Affected software

Vendor	Product	Versions
Atsumi Electric Co., Ltd.	ADX5004	< Ver.10.8.237
Atsumi Electric Co., Ltd.	ADX5008	< Ver.10.8.237
Atsumi Electric Co., Ltd.	ADX404	< Ver.10.8.237
Atsumi Electric Co., Ltd.	ADX3004	< Ver.10.8.237
Atsumi Electric Co., Ltd.	ADX3008	< Ver.10.8.237
Atsumi Electric Co., Ltd.	ADX3016	< Ver.10.8.237
Atsumi Electric Co., Ltd.	ADX204	< Ver.10.8.237
Atsumi Electric Co., Ltd.	ADX1004	all versions
Atsumi Electric Co., Ltd.	ADX1008	all versions
Atsumi Electric Co., Ltd.	ADX2016	all versions

References

Timeline

Published: Oct 20, 2026
Last modified: Oct 20, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1007397.3A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unkn CVE-2026-100744.9DreamMaker developed by Interinfo has an Arbitrary File Read vulnerability, allowing privileged local attackers to exploit Relative Path Tra CVE-2026-1007409.9A vulnerability was detected in D-Link DIR-895L A1_102b07. Impacted is the function tunnel_set_params of the file tunnel.c of the component CVE-2026-1007419.8Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allow CVE-2026-1007447.3A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpda CVE-2026-1007456.3A vulnerability has been found in Edimax BR-6428nC 1.16. The impacted element is an unknown function of the file /goform/formWizSurvey of th CVE-2026-1007467.3A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/CVE-2026-1007476.5Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due to lack of an CSRF token check, a third-par CVE-2026-1007488.8Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0 CVE-2026-1007494.3Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0 - Only orphaned file entries and shopp CVE-2026-100755.3DreamMaker developed by Interinfo has a Path Traversal vulnerability, allowing unauthenticated remote attackers to read file names under arb CVE-2026-1007507.5Joomla Extension - regularlabs.com - LFI / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla - Modules Anywhere Pro lets additional attribut