CVE-2026-94367
OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. An authenticated administrator can supply crafted backup-area configuration input that is passed to a shell command, allowing commands to execute with the privileges of the nvr user. The underlying design has been present since at least firmware 2.2.3.4. This vulnerability is resolved in OpenEye Apex version 3.4.3.
CVE-2026-94367
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-94367
Apex Network Video Recorder (NVR)
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "OpenEye",
"product": "Apex Network Video Recorder (NVR)",
"versions": [
{
"status": "affected",
"version": "3.2.9.376"
},
{
"status": "unaffected",
"version": "3.4.3"
}
],
"defaultStatus": "unknown"
}
]- Related CVEs
- CVE-2026-94367
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #2355 · Revision 1
- Added to Heist Feed
- Publisher date