CVE-2026-94367 OpenEye CVE debrief

Who should care

Defenders responsible for OpenEye Apex Network Video Recorder (NVR) systems, including security teams, IT administrators, and network operators, should assess exposure and apply the vendor-provided patch to prevent exploitation. This includes reviewing current firmware versions, updating access controls, and monitoring for suspicious activity related to the vulnerability. Prioritization should be based on the criticality of the affected systems and the NVR

Why it matters

CVE-2026-94367 is an OS command injection vulnerability in OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 that allows authenticated administrators to execute commands with elevated privileges. Defenders should prioritize verifying exposure and applying the vendor-provided patch to prevent exploitation.

• Potential command execution with elevated privileges
• Possible disruption of video recording and monitoring capabilities
• Potential lateral movement within the network
• Requires verification of exposure and patch application

Technical summary

The vulnerability exists in the recbackup component of OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376. An authenticated administrator can supply crafted backup-area configuration input that is passed to a shell command, allowing commands to execute with the privileges of the nvr user. This OS command injection vulnerability can lead to potential command execution with elevated privileges, possible disruption of video recording and monitoring capabilities, and potential lateral movement within the network. The vulnerability is resolved in OpenEye Apex version 3.4.3.

Defensive priority

Defenders should prioritize verifying exposure and applying the vendor-provided patch.

Recommended defensive actions

• Verify exposure by checking the current firmware version of OpenEye Apex Network Video Recorder (NVR) and comparing it to the patched version 3.4.3.
• Apply the vendor-provided patch to prevent exploitation.
• Monitor for potential suspicious activity related to the vulnerability.
• Review and update access controls and authentication mechanisms for the NVR.
• Conduct a thorough review of the network for potential lateral movement.
• Inventory affected systems and prioritize patching based on criticality.
• Track patch application and verify remediation success.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376, specifically an OS command injection vulnerability in the recbackup component. However, the scope of affected versions, potential impact, and specific defensive measures require further verification. Defenders should review the vendor-provided patch and assess exposure, considering the privileges of the nvr user and potential command execution risks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.