CVE-2026-92929 PUBLISHED

Assigner: Securifera
Reserved: 17.09.2026 Published: 22.09.2026 Updated: 23.09.2026

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request source address. An unauthenticated remote attacker can spoof a loopback address to bypass local-connection-only security controls exposed on the affected non-TLS web interfaces and disclose configuration information. The underlying design has been present since at least firmware 2.2.3.4.

Upgrade to version 3.5.4.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 5.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	OpenEye
Product	Apex Network Video Recorder (NVR)
Versions	Default: unknown Version 3.2.9.376 is affected

Solutions

Upgrade to version 3.5.4.

Credits

Ryan Wincey (@rwincey, Securifera) finder

References

Problem Types

CWE-290: Authentication Bypass by Spoofing CWE