CVE-2026-92929: Medium severity OpenEye Apex Network Video Recorder (NVR) vulnerability
OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request source address. An unauthenticated remote attacker can spoof a loopback address to bypass local-connection-only security controls exposed on the affected non-TLS web interfaces and disclose configuration information. The underlying design has been present since at least firmware 2.2.3.4.
Upgrade to version 3.5.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEye Apex Network Video Recorder (NVR) firmwareto a version that resolves this vulnerability.Fixed in 3.5.4
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
OpenEye Apex NVR systems using the affected non-TLS web interfaces are exposed if they run firmware 3.2.9.376 or a version with the underlying design, which has been present since at least 2.2.3.4. The issue affects controls that rely on the request appearing to originate from a local connection.
What does an attacker need to exploit it?
An attacker needs remote network access to an affected non-TLS web interface. No authentication or user interaction is required; the attacker supplies a spoofed X-Forwarded-For header containing a loopback address.
What can successful exploitation allow?
Successful exploitation bypasses local-connection-only security controls and can disclose configuration information. The provided severity vector indicates confidentiality impact only, with no stated integrity or availability impact.
What should be done if the NVR cannot be upgraded immediately?
Restrict remote access to the affected non-TLS web interfaces so untrusted clients cannot reach them. This reduces the opportunity for an unauthenticated remote client to submit spoofed X-Forwarded-For headers; upgrade to firmware 3.5.4 when possible.
How can I determine whether a system may be affected?
Check the NVR firmware version and whether its non-TLS web interface is reachable by remote clients. Firmware 3.2.9.376 is affected, and the vulnerable design has existed since at least firmware 2.2.3.4; version 3.5.4 is the stated upgrade target.