OS Command Injection in OpenEye Apex NVR Firmware
CVE-2026-94367

7.2HIGH

Key Information:

Vendor

Openeye

Status
Apex Network Video Recorder (nvr)
Vendor
CVE Published:
22 September 2026

What is CVE-2026-94367?

The OpenEye Apex Network Video Recorder firmware includes a critical OS command injection vulnerability found in the recbackup function. This flaw allows authenticated administrators to introduce malicious backup-area configuration inputs that can be executed as shell commands with the privileges of the nvr user. This vulnerability has persisted in the system since previous firmware versions, emphasizing the need for immediate updates. Users should upgrade to firmware version 3.5.4 or later to mitigate this risk and protect their network environments.

Affected Version(s)

Apex Network Video Recorder (NVR) 3.2.9.376

References

https://portal.openeye.net/updates/issue-alerts/1061
https://www.securifera.com/advisories/

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ryan Wincey (@rwincey, Securifera)
.