The vulnerability is an OS command injection flaw in the recbackup component of OpenEye Apex Network Video Recorder firmware. An authenticated administrator can supply specially crafted backup‑area configuration data that is appended to a shell command, enabling arbitrary command execution with the nvr user’s privileges. Because the issue exists in firmware versions as early as 2.2.3.4 and continues through 3.2.9.376, a wide range of devices may be affected. The flaw, identified as CWE‑78, lets an attacker modify or delete data and regain control over the device’s operating system. The vendor has fixed the vulnerability in firmware 3.4.3.

Affected products are OpenEye Apex Network Video Recorder firmware 3.2.9.376 and earlier releases as far back as firmware 2.2.3.4. The vendor recommends upgrading to firmware 3.4.3 to remediate the vulnerability.

The CVSS score of 7.2 indicates a moderate to high severity vulnerability. Exploitation requires authenticated administrative access, meaning that attackers with privileged credentials can fully compromise the device. The EPSS score is 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation in the wild. Nevertheless, the potential impact of code execution makes timely remediation important, especially in environments where administrative accounts may be accessible over the network.