# CVE-2026-92929: OpenEye Apex Network Video Recorder header spoofing bypass

Source: https://junglewise.ai/threats/cve-2026-92929-openeye-apex-network-video-recorder-nvr-firmware-3-2-9-376-trusts  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92929 · Severity: medium · CVSS 5.3 · Published 2026-09-23

OpenEye Apex Network Video Recorder is a video surveillance system that records and manages security camera feeds. The firmware trusts client-supplied X-Forwarded-For headers to determine request origin, allowing remote attackers to spoof a local connection and bypass security controls that restrict access to sensitive features. An attacker can exploit this to extract system configuration details without authentication.

Technologies: [OpenEye Apex Network Video Recorder](https://junglewise.ai/threats/technologies/apex-network-video-recorder). Vendors: [OpenEye](https://junglewise.ai/threats/vendors/openeye).

## Quick answers

**Is CVE-2026-92929 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92929 being exploited in the wild.

**How severe is CVE-2026-92929?** Medium severity, with a CVSS score of 5.3, published 23 September 2026.

**Which products and versions are affected?** OpenEye Apex Network Video Recorder 3.2.9.376 and earlier (vulnerable since at least 2.2.3.4); fixed in 3.5.4 and later.

**Is there a fix for CVE-2026-92929?** A patch was published on 2026-09-23: Version 3.5.4 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92929 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-92929?** Check whether you run OpenEye Apex Network Video Recorder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The NVR firmware fails to validate the X-Forwarded-For HTTP header, allowing unauthenticated remote attackers to spoof a loopback address and bypass local-connection-only access controls on non-TLS web interfaces. This design flaw has existed since firmware 2.2.3.4. Exploitation requires only network access to the unencrypted web interface and results in unauthorized disclosure of configuration information.

## Affected products

- OpenEye Apex Network Video Recorder 3.2.9.376 and earlier (vulnerable since at least 2.2.3.4); fixed in 3.5.4 and later

## Timeline

- 2026-09-23: disclosed
- 2026-09-23: patched: Version 3.5.4 and later

## References

- [https://portal.openeye.net/updates/issue-alerts/1059](https://portal.openeye.net/updates/issue-alerts/1059)
- [https://www.securifera.com/advisories/](https://www.securifera.com/advisories/)

## Related threats

- [OpenEye Apex Network Video Recorder OS command injection in recbackup](https://junglewise.ai/threats/cve-2026-94367-openeye-apex-network-video-recorder-nvr-firmware-3-2-9-376)
- [OpenEye Apex Network Video Recorder hardcoded recovery account authentication bypass](https://junglewise.ai/threats/cve-2026-92928-openeye-apex-network-video-recorder-nvr-firmware-3-2-9-376)