CVE-2026-92929
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Summary
OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request source address. An unauthenticated remote attacker can spoof a loopback address to bypass local-connection-only security controls exposed on the affected non-TLS web interfaces and disclose configuration information. The underlying design has been present since at least firmware 2.2.3.4.
Upgrade to version 3.5.4.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| OpenEye | Apex Network Video Recorder (NVR) | 3.2.9.376 | affected |
Weaknesses
- CWE-290: CWE-290: Authentication Bypass by Spoofing
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.