CVE-2026-94367 Overview
CVE-2026-94367 is an operating system command injection vulnerability [CWE-78] in OpenEye Apex Network Video Recorder (NVR) firmware version 3.2.9.376. The flaw resides in the recbackup component, which passes attacker-controlled backup-area configuration input to a shell command without adequate sanitization. An authenticated administrator can inject arbitrary commands that execute with the privileges of the nvr user. OpenEye states the underlying design has been present since at least firmware 2.2.3.4, indicating a long-standing exposure across deployed devices. The vendor addressed the issue in firmware 3.5.4.
Critical Impact
Authenticated administrators can execute arbitrary OS commands on affected NVR appliances, gaining code execution as the nvr service account and enabling persistent compromise of video surveillance infrastructure.
Affected Products
- OpenEye Apex NVR firmware 3.2.9.376
- OpenEye Apex NVR firmware versions from 2.2.3.4 up to (but not including) 3.5.4
- OpenEye Apex NVR appliances running the recbackup component
Discovery Timeline
- 2026-09-23 - CVE-2026-94367 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-94367
Vulnerability Analysis
The vulnerability exists in the recbackup functionality of OpenEye Apex NVR firmware. The component accepts backup-area configuration input from administrative users and incorporates that input into a shell command string. Because the input is not properly validated or escaped before being passed to the shell, attackers can break out of the intended argument context using shell metacharacters. Successful exploitation yields command execution under the nvr user account, which controls the video recording service. From that foothold, attackers can tamper with recorded footage, pivot into the internal network, or establish persistence on the appliance. The vulnerability requires authentication as an administrator, limiting exposure to insiders and to attackers who obtain administrative credentials through phishing, credential stuffing, or default password reuse.
Root Cause
The root cause is unsafe construction of shell command strings using unsanitized user input, classified as Improper Neutralization of Special Elements used in an OS Command [CWE-78]. The recbackup code path concatenates administrator-supplied configuration data directly into a command executed by the system shell rather than invoking the target binary with an argument array or applying strict allowlist validation.
Attack Vector
Exploitation requires network access to the NVR management interface and valid administrator credentials. An attacker submits crafted backup-area configuration containing shell metacharacters such as command separators, backticks, or subshell syntax. When recbackup executes, the injected payload runs as the nvr user. For technical specifics, refer to the OpenEye Issue Alert #1061 and the Securifera Security Advisory.
// No verified proof-of-concept code has been published.
// See the vendor and researcher advisories linked above for technical details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-94367
Indicators of Compromise
- Unexpected child processes spawned by the recbackup process or the nvr service account, particularly shells such as /bin/sh, /bin/bash, or interpreters like python and perl.
- Outbound network connections initiated by the nvr user to unfamiliar hosts, which may indicate reverse shells or data exfiltration.
- Backup configuration entries containing shell metacharacters such as ;, |, &, backticks, or $(...) sequences.
Detection Strategies
- Monitor process ancestry on NVR appliances for shell invocations descending from recbackup or related backup workflows.
- Review NVR administrative audit logs for backup configuration changes correlated with unusual system activity.
- Deploy network monitoring to flag anomalous egress from video surveillance VLANs, which should typically communicate only with the video management server.
Monitoring Recommendations
- Alert on any interactive shell activity under the nvr user account, which should not normally spawn interactive processes.
- Baseline expected outbound destinations for NVR devices and alert on deviations.
- Track firmware versions across the fleet and flag any device still running versions prior to 3.5.4.
How to Mitigate CVE-2026-94367
Immediate Actions Required
- Upgrade all OpenEye Apex NVR appliances to firmware version 3.5.4 or later, as directed in OpenEye Issue Alert #1061.
- Rotate all administrator credentials on affected NVR devices and enforce strong, unique passwords.
- Restrict management interface access to a dedicated administrative network segment using firewall rules or VLAN isolation.
Patch Information
OpenEye released firmware version 3.5.4 to remediate the command injection in recbackup. Administrators should download the update through the OpenEye customer portal and apply it to every deployed Apex NVR. Verify the installed firmware version after the update and confirm that backup functionality operates as expected.
Workarounds
- Limit administrator account issuance to trusted personnel and audit existing accounts for necessity.
- Place NVR appliances behind network access controls that restrict management traffic to known administrator workstations.
- Disable or avoid modifying backup-area configuration on unpatched devices until the firmware update is applied.
# Example: restrict NVR management access at the network edge
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
