CVE-2026-94367 - OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup

Back Back to CVE browser

HIGH

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup

Published Sep 22, 2026

7.2

HIGH

CVSS 3.1

EPSS 1.03%

Description

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. An authenticated administrator can supply crafted backup-area configuration input that is passed to a shell command, allowing commands to execute with the privileges of the nvr user. The underlying design has been present since at least firmware 2.2.3.4.

This vulnerability is resolved in OpenEye Apex version 3.4.3.

Affected products

Vendor OpenEye Product Apex Network Video Recorder (NVR) Default
n/a
- Version
  3.2.9.376
  Status
  affected
  Constraints
  -
- Version
  3.4.3
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

OpenEye

Apex Network Video Recorder (NVR)

n/a

Version	Status	Constraints
3.2.9.376	affected	-
3.4.3	unaffected	-

Remediation

Vendor solution

Upgrade to OpenEye Apex version 3.4.3.

Weaknesses (1)

CWE-78

OS Command Injection

References (3)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-84985		Advisory
https://portal.openeye.net/updates/issue-alerts/1061
https://www.securifera.com/advisories/