CyberRota Analysis
AI-GeneratedThe OpenEye Apex Network Video Recorder firmware is vulnerable to an OS command injection flaw in the recbackup feature, allowing authenticated administrators to execute arbitrary shell commands with nvr user privileges through manipulated backup-area configuration inputs. This vulnerability poses a significant risk as it could lead to unauthorized access and control over the NVR system. Organizations using affected firmware versions should prioritize upgrading to version 3.5.4 to mitigate potential exploitation.
Original NVD Description
OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. An authenticated administrator can supply crafted backup-area configuration input that is passed to a shell command, allowing commands to execute with the privileges of the nvr user. The underlying design has been present since at least firmware 2.2.3.4. This vulnerability is resolved in OpenEye Apex version 3.4.3.