Skip to content
CVE PROGRAM SOURCE RECORD6.2 Medium

CVE-2026-92930

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 uses an administrator password-reset unlock-code design that lacks a per-device secret or other server-side cryptograph

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Securifera

Description

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 uses an administrator password-reset unlock-code design that lacks a per-device secret or other server-side cryptographic material. An attacker with physical-console access and access to the privileged password-reset workflow can forge a valid unlock code offline and use it to reset the administrator password. The underlying design has been present since at least firmware 2.2.3.4. Upgrade to version 3.5.4.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

OpenEye Apex Network Video Recorder (NVR)

Default version status: unknown

  • 3.2.9.376affected

References