The vulnerability is a hidden feature that allows an authenticated administrator to run arbitrary operating system commands on the DVR, giving full control of the device and potentially compromising confidentiality, integrity, and availability. It is a classic example of improper input handling or design flaws (CWE‑912).

Atsumi Electric Co., Ltd. produces several DVR models affected by this issue, including the ADX1004, ADX1008, ADX2016, ADX204, ADX3004, ADX3008, ADX3016, ADX404, ADX5004, and ADX5008 series. The firmware on these models does not include the patch that removes the hidden command functionality, leaving them vulnerable to arbitrary OS command execution for users with administrator privileges.

The CVSS score of 8.6 indicates a high severity, while the EPSS score is currently unavailable, reflecting uncertainty about the current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, yet its impact warrants immediate action. An attacker who obtains or exploits an administrator login—through legitimate credentials, phishing, or known default accounts—can trigger the hidden functionality to execute any command on the host operating system, potentially achieving full device takeover. The lack of a vendor‑provided workaround removes any partial mitigation, making exploitation relatively straightforward once credentials are in hand.