CVE-2026-92930
MediumCVSS 6.2Summary
OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 uses an administrator password-reset unlock-code design lacking a per-device secret or server-side cryptographic material. An attacker with physical-console access and access to the privileged password-reset workflow can forge a valid unlock code offline and reset the administrator password. The design has been present since at least firmware 2.2.3.4.
Risk Assessment
An attacker with physical access to the device can take over the administrator account, leading to full compromise of the NVR and potentially the entire surveillance infrastructure.
Recommendation
Upgrade the firmware to version 3.5.4.
Other vulnerabilities in OpenEye Apex Network Video Recorder (NVR)
See all- CVE-2026-92929Medium
OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request source address. An unauthenticated remote attacker can spoof a loopback address to bypass local-connection-only security controls on non-TLS web interfaces and disclose configuration information. The design has been present since at least firmware 2.2.3.4.
- CVE-2026-92928Medium
OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled, or rotated. An unauthenticated remote attacker can use the account to authenticate to the password-reset workflow. The account does not provide normal administrator access; additional vulnerabilities are required for administrator takeover. The design has been present since at least firmware 2.2.3.4.
Original NVD description (English source)
OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 uses an administrator password-reset unlock-code design that lacks a per-device secret or other server-side cryptographic material. An attacker with physical-console access and access to the privileged password-reset workflow can forge a valid unlock code offline and use it to reset the administrator password. The underlying design has been present since at least firmware 2.2.3.4. Upgrade to version 3.5.4.