CVE-2026-92928

6.5 Moyenne

Publiée le 23/09/2026 à 02:16 · Modifiée le 24/09/2026 à 23:08 · Analyse NVD reportée · Source : contact@securifera.com

Description

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled, or rotated. An unauthenticated remote attacker can use the account to authenticate to the password-reset workflow. The account does not provide normal administrator access; additional vulnerabilities are required to obtain an administrator takeover. The underlying design has been present since at least firmware 2.2.3.4. Upgrade to version 3.5.4.

Traduire en français

Produits concernés

OpenEye Apex Network Video Recorder (NVR)

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	contact@securifera.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-798

Références

https://portal.openeye.net/updates/issue-alerts/1058
https://www.securifera.com/advisories/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories