---
id: CVE-2026-94367
title: >-
  OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS
  command injection vulnerability in recbackup
summary: >-
  OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS
  command injection vulnerability in recbackup. An authenticated administrator
  can supply crafted backup-area configuration input that is passed to a shell
  command…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
vendor: OpenEye
product: Apex Network Video Recorder (NVR)
affected:
  - apex_network_video_recorder_nvr 3.2.9.376
published: '2026-09-23'
updated: '2026-09-26'
sourceUpdated: '2026-09-26T12:17:35.413'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-94367'
references:
  - url: 'https://portal.openeye.net/updates/issue-alerts/1061'
    label: contact@securifera.com
  - url: 'https://www.securifera.com/advisories/'
    label: contact@securifera.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-23T13:44:23.711465Z'
epss: 0.01026
epssPercentile: 0.63442
ingestedAt: '2026-09-23T00:14:05.314Z'
---

## Overview

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. An authenticated administrator can supply crafted backup-area configuration input that is passed to a shell command, allowing commands to execute with the privileges of the nvr user. The underlying design has been present since at least firmware 2.2.3.4.

This vulnerability is resolved in OpenEye Apex version 3.4.3.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.