The vulnerability is a hidden functionality flaw that permits any user who can log in with administrator privileges to load and install firmware that has not been authorized by the manufacturer. This flaw effectively bypasses the intended firmware integrity checks and allows an administrator to upgrade the device to a custom or malicious firmware version. The effect is a loss of control over the device, allowing an attacker to gain persistent foothold, modify or disable critical security functions, and potentially use the device as part of a larger compromised network. The weakness is categorized as Broken Access Control (CWE-912).

Affected products are a range of digital video recorders manufactured by Atsumi Electric Co., Ltd., including the ADX1004, ADX1008, ADX2016, ADX204, ADX3004, ADX3008, ADX3016, ADX404, ADX5004, and ADX5008 models. Specific firmware versions impacted are not disclosed in the available data, so all current firmware versions on these models may potentially be vulnerable until a vendor patch is released or the feature is disabled.

The CVSS base score for this vulnerability is 6.9, representing a moderate severity level. Because the EPSS score is not reported, the likelihood of exploitation cannot be quantified, but the vulnerability requires that an attacker has access to an administrator account, which suggests that exploitation would most likely occur in a localized or network‑based environment where privileged credentials can be obtained. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation has been reported. Nonetheless, the ability to load unauthenticated firmware grants an attacker significant control over the device, warranting cautious monitoring and prompt patching when available.