CVE-2026-92929CWE-290

CVE-2026-92929

Medium · published September 23, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
28.3
In the wild
Unconfirmed
What it is

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request source address. An unauthenticated remote attacker can spoof a loopback address to bypass local-connection-only security controls exposed on the affected non-TLS web interfaces and disclose configuration information. The underlying design has been present since at least firmware 2.2.3.4.

Upgrade to version 3.5.4.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00357 · 28.3th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2026-09-23T04:17Z
References (2)
https://portal.openeye.net/updates/issue-alerts/1059 · [email protected]https://www.securifera.com/advisories/ · [email protected]
EPSS history
Timeline
  • 24 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 22 SEP 23:10Z
    OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request…
    cvelistv5