Upgrade to version 3.5.4.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| OpenEye | Apex Network Video Recorder (NVR) | unknown |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
Upgrade to version 3.5.4.
Workaround
No workaround given by the vendor.
Wed, 23 Sep 2026 00:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Bypass of Local-Connection-Only Controls via Spoofed X-Forwarded-For Header |
Tue, 22 Sep 2026 23:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request source address. An unauthenticated remote attacker can spoof a loopback address to bypass local-connection-only security controls exposed on the affected non-TLS web interfaces and disclose configuration information. The underlying design has been present since at least firmware 2.2.3.4. Upgrade to version 3.5.4. | |
| Weaknesses | CWE-290 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Securifera
Published:
Updated: 2026-09-22T23:19:15.124Z
Reserved: 2026-09-17T12:03:24.121Z
Link: CVE-2026-92929
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-23T00:17:00.897
Modified: 2026-09-23T00:17:00.897
Link: CVE-2026-92929
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-09-23T00:30:18Z