OpenEye Apex NVR CVE-2026-94367

Requires an authenticated OpenEye Apex NVR administrator account (PR:H) with access to the backup-area configuration feature that feeds the recbackup routine; the attacker must be able to reach the management interface over the network (AV:N) but no user interaction is needed. Limiting factors: administrator-level authentication is mandatory, so exploitation is confined to insiders, credential-theft scenarios, or NVRs left on default/weak admin credentials; commands run only as the unprivileged nvr user (not root), bounding immediate impact to that account's privileges. Affects firmware from at least 2.2.3.4 through 3.2.9.376; fixed in 3.5.4.

This is a genuine but access-gated vulnerability. The CVSS 7.2 (HIGH) reflects full compromise impact (C:H/I:H/A:H) via low-complexity network attack (AV:N/AC:L), but the critical limiter is PR:H - exploitation requires an already-authenticated administrator, which substantially narrows the real-world attacker population and puts this in the post-authentication privilege-context-escalation category rather than a pre-auth mass-exploitation threat. No EPSS score, KEV listing, or public POC was provided in the input, so there is no signal of active exploitation or automated weaponization at time of analysis. The most meaningful risk factor is longevity: the vendor states the flawed design has existed since at least firmware 2.2.3.4, meaning a very large window of vulnerable deployed devices exists in the field. Net priority is MODERATE - patch on a normal cadence unless the NVR admin interface is exposed to untrusted networks or shares credentials with other systems, in which case treat it more urgently. No signals conflict; the CVSS vector and the description (authenticated administrator) are internally consistent.

An attacker who has obtained or been granted administrator credentials to the OpenEye Apex NVR web/management interface submits crafted backup-area configuration input; that input is concatenated into a shell command in the recbackup routine and executes with the privileges of the nvr user. This yields arbitrary command execution on the recorder - enabling tampering with or deletion of surveillance footage, pivoting into the physical-security network, or bricking the device. No public exploit was identified in the provided data, though the vulnerability was documented by security research firm Securifera.