Vulnerability · Published Sep 22, 2026 · Assigned by Securifera
CVE-2026-92928
Medium 6.5
In plain English
A medium-severity hard-coded credentials in Apex Network Video Recorder (NVR) from OpenEye. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).
Official description
OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled, or rotated. An unauthenticated remote attacker can use the account to authenticate to the password-reset workflow. The account does not provide normal administrator access; additional vulnerabilities are required to obtain an administrator takeover. The underlying design has been present since at least firmware 2.2.3.4. Upgrade to version 3.5.4.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OpenEye | Apex Network Video Recorder (NVR) | 3.2.9.376 |
Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N