CVE-2026-94367
HIGH
NVD
CVSS Score
7.2
Severity
HIGH
Published
Sep 23, 2026
Vendor
unknown
Description
OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. An authenticated administrator can supply crafted backup-area configuration input that is passed to a shell command, allowing commands to execute with the privileges of the nvr user. The underlying design has been present since at least firmware 2.2.3.4. Upgrade to version 3.5.4.