Openeye
Monthly
OS command injection in OpenEye Apex Network Video Recorder firmware (2.2.3.4 through 3.2.9.376) allows an authenticated administrator to feed crafted backup-area configuration input into the recbackup routine, where it is passed unsanitized to a shell and executed with the privileges of the nvr service account. Rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), the issue is genuinely exploitable but access-gated: the attacker must already hold an administrator account and reach the management interface over the network, which confines realistic exposure to insiders, credential-theft or credential-reuse scenarios, and NVRs left on default or weak admin passwords. No public exploit code or confirmed active exploitation has been identified at time of analysis; OpenEye has released firmware 3.5.4 as the fix, with supporting detail in vendor advisory 1061 and the Securifera advisory.
Administrator password takeover in OpenEye Apex Network Video Recorder (NVR) firmware up to 3.2.9.376 is possible because the password-reset unlock-code scheme lacks a per-device secret or any server-side cryptographic material, allowing an attacker who reaches the privileged reset workflow to compute a valid unlock code entirely offline and reset the administrator password. Exploitation is not remote: it requires physical console access to the device and use of the privileged password-reset workflow (CVSS:3.1/AV:P/AC:L/PR:H/UI:N, score 6.2), so it is neither remotely reachable nor automatically triggered. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor has released firmware 3.5.4 as the fix, and the vulnerable design has been present since at least firmware 2.2.3.4.
Configuration information disclosure in OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 arises because the firmware trusts a client-supplied X-Forwarded-For header when determining the request's source address, so an unauthenticated remote attacker can spoof a loopback address such as 127.0.0.1 and defeat local-connection-only controls on the appliance's non-TLS web interfaces. Successful abuse discloses configuration information only; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms no integrity or availability impact and no authentication or user interaction requirement. The flawed design has been present since at least firmware 2.2.3.4, is fixed in 3.5.4, and no public exploit has been identified at time of analysis, consistent with this being a genuine but modest-severity issue.
Unauthenticated remote attackers can authenticate to the password-reset workflow of OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 using a hardcoded, shared recovery credential (CWE-798) that cannot be changed, disabled, or rotated. This flaw has been present since at least firmware 2.2.3.4 and grants only access to the password-reset workflow, not normal administrator privileges; full admin takeover requires chaining additional vulnerabilities. The CVSS 3.1 score is 6.5 (MEDIUM) with LOW confidentiality and integrity impact, and no public exploit code has been identified at time of analysis. Upgrade to firmware 3.5.4 to remediate.
OS command injection in OpenEye Apex Network Video Recorder firmware (2.2.3.4 through 3.2.9.376) allows an authenticated administrator to feed crafted backup-area configuration input into the recbackup routine, where it is passed unsanitized to a shell and executed with the privileges of the nvr service account. Rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), the issue is genuinely exploitable but access-gated: the attacker must already hold an administrator account and reach the management interface over the network, which confines realistic exposure to insiders, credential-theft or credential-reuse scenarios, and NVRs left on default or weak admin passwords. No public exploit code or confirmed active exploitation has been identified at time of analysis; OpenEye has released firmware 3.5.4 as the fix, with supporting detail in vendor advisory 1061 and the Securifera advisory.
Administrator password takeover in OpenEye Apex Network Video Recorder (NVR) firmware up to 3.2.9.376 is possible because the password-reset unlock-code scheme lacks a per-device secret or any server-side cryptographic material, allowing an attacker who reaches the privileged reset workflow to compute a valid unlock code entirely offline and reset the administrator password. Exploitation is not remote: it requires physical console access to the device and use of the privileged password-reset workflow (CVSS:3.1/AV:P/AC:L/PR:H/UI:N, score 6.2), so it is neither remotely reachable nor automatically triggered. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor has released firmware 3.5.4 as the fix, and the vulnerable design has been present since at least firmware 2.2.3.4.
Configuration information disclosure in OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 arises because the firmware trusts a client-supplied X-Forwarded-For header when determining the request's source address, so an unauthenticated remote attacker can spoof a loopback address such as 127.0.0.1 and defeat local-connection-only controls on the appliance's non-TLS web interfaces. Successful abuse discloses configuration information only; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms no integrity or availability impact and no authentication or user interaction requirement. The flawed design has been present since at least firmware 2.2.3.4, is fixed in 3.5.4, and no public exploit has been identified at time of analysis, consistent with this being a genuine but modest-severity issue.
Unauthenticated remote attackers can authenticate to the password-reset workflow of OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 using a hardcoded, shared recovery credential (CWE-798) that cannot be changed, disabled, or rotated. This flaw has been present since at least firmware 2.2.3.4 and grants only access to the password-reset workflow, not normal administrator privileges; full admin takeover requires chaining additional vulnerabilities. The CVSS 3.1 score is 6.5 (MEDIUM) with LOW confidentiality and integrity impact, and no public exploit code has been identified at time of analysis. Upgrade to firmware 3.5.4 to remediate.