Read the docs
TI-2026-63397 Aliases CVE-2026-94367GHSA-xr8v-x794-fm52

OS command injection in OpenEye Apex Network Video Recorder

Priority LOW 36CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. An authenticated administrator can supply crafted backup-area configuration input that is passed to a shell command, allowing commands to execute with the privileges of the nvr user. The underlying design has been present since at least firmware 2.2.3.4. This vulnerability is resolved in OpenEye Apex version 3.4.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01026 63rd percentileScored 2026-11-07
Fix Fixed Apex Network Video Recorder (NVR) (OpenEye): 3.4.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenEyeApex Network Video Recorder (NVR)3.2.9.3763.4.3Patch availableCNA
  • Apex Network Video Recorder (NVR) VendorOpenEye Affected 3.2.9.376 Fixed in 3.4.3 Patch available CNA

Remediation

  • Fix · CNA Apex Network Video Recorder (NVR) (OpenEye) Fixed in 3.4.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-94367
  2. 2026-10-03 Alias added: GHSA-xr8v-x794-fm52

References

Other 2

  • TI-2026-62592 Hard-coded credentials in OpenEye Apex Network Video Recorder CVSS 3.1MEDIUM 6.5
  • TI-2026-62593 Authentication bypass by spoofing in OpenEye Apex Network Video Recorder CVSS 3.1MEDIUM 5.3
  • TI-2026-62594 OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 uses an administrator… CVSS 3.1MEDIUM 6.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences