CVE-2026-92929
MediumCVSS 5.3Summary
OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request source address. An unauthenticated remote attacker can spoof a loopback address to bypass local-connection-only security controls on non-TLS web interfaces and disclose configuration information. The design has been present since at least firmware 2.2.3.4.
Risk Assessment
An attacker can access configuration information that should only be available locally, facilitating further attacks on the device and network.
Recommendation
Upgrade the firmware to version 3.5.4.
Other vulnerabilities in OpenEye Apex Network Video Recorder (NVR)
See all- CVE-2026-92930Medium
OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 uses an administrator password-reset unlock-code design lacking a per-device secret or server-side cryptographic material. An attacker with physical-console access and access to the privileged password-reset workflow can forge a valid unlock code offline and reset the administrator password. The design has been present since at least firmware 2.2.3.4.
- CVE-2026-92928Medium
OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled, or rotated. An unauthenticated remote attacker can use the account to authenticate to the password-reset workflow. The account does not provide normal administrator access; additional vulnerabilities are required for administrator takeover. The design has been present since at least firmware 2.2.3.4.
Original NVD description (English source)
OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request source address. An unauthenticated remote attacker can spoof a loopback address to bypass local-connection-only security controls exposed on the affected non-TLS web interfaces and disclose configuration information. The underlying design has been present since at least firmware 2.2.3.4. Upgrade to version 3.5.4.