CVE-2026-97627
7.2HighPublished 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-912
Impact
Authenticated administrators can execute arbitrary OS commands directly on the DVR. An attacker first needs network access to the device web interface and valid administrator credentials.
Root cause
The device firmware contains undocumented hidden functionality (backdoor or debug interface) that permits direct OS command execution.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.0 · CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Apply the firmware update specified in Atsumi advisory info-20261005.html. As an interim workaround, isolate the DVR management interfaces to a private, restricted VLAN and revoke untrusted administrator access.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may execute arbitrary OS commands.