Vulnerability

CVE-2026-94367

Descriptive record received from OpenCTI and minimised for consultation in the Intel portal.

Sharing: PUBLIC-OSINT
Confidence: 100
Source: The CVE Program
Updated: 26/09/2026 14:14

Description

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. An authenticated administrator can supply crafted backup-area configuration input that is passed to a shell command, allowing commands to execute with the privileges of the nvr user. The underlying design has been present since at least firmware 2.2.3.4. This vulnerability is resolved in OpenEye Apex version 3.4.3.

STIX identifiervulnerability--92ed4f17-2a01-5563-a092-7526cdde3e7c

First observation-

Last observation-

Known relationships8

Aliases and classifications

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Minimised technical details

No raw data

cvss score: 7.2
cvss severity: HIGH
cisa kev: False
cvss vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Provenance

Public references

https://portal.openeye.net/updates/issue-alerts/1061
https://portal.openeye.net/updates/issue-alerts/1061
https://www.securifera.com/advisories/
https://www.securifera.com/advisories/

EudorIA correlation

Intel catalogue

The vulnerability is also available in the EudorIA editorial catalogue.

Open EudorIA analysis

Presence in OpenCTI describes an intelligence correlation and does not, by itself, constitute evidence of compromise, legal attribution or operational guidance applicable without context verification.