OpenEye Apex NVR CVE-2026-92928

Exploitation requires network reachability to the OpenEye Apex NVR management/password-reset interface on firmware 3.2.9.376 (design present since at least 2.2.3.4). No authentication is needed because the attacker supplies the undocumented, shared hardcoded recovery credential (CWE-798), which cannot be changed, disabled, or rotated. The critical limiting factor is impact scope: the recovery account only reaches the password-reset workflow and does NOT grant normal administrator access - full administrator takeover requires chaining separate, additional vulnerabilities not covered by this CVE. Mitigation is upgrading to firmware 3.5.4.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N = 6.5, MEDIUM) is internally consistent with the description: a network-reachable, low-complexity, unauthenticated flaw with only LOW confidentiality and LOW integrity impact and no availability impact. The comparatively modest score is well-justified because the vendor and Securifera both stress that the hardcoded recovery account 'does not provide normal administrator access' - it only lets an attacker authenticate to the password-reset workflow, and additional (separate) vulnerabilities are required to reach full administrator takeover. This is therefore best understood as a chainable foothold rather than a standalone critical breach. No EPSS score, CISA KEV listing, or public exploit code is present in the provided data, so this is no public exploit identified at time of analysis; there is no evidence of active exploitation. The primary risk driver is that the credential is hardcoded, shared across the fleet, and cannot be changed, disabled, or rotated, and has been present since at least firmware 2.2.3.4 - meaning every unpatched Apex NVR shares the same permanent backdoor-class weakness. Real priority is moderate: high exposure and trivial reachability, but capped real-world impact absent the follow-on vulnerabilities needed for takeover. Note the tension between the CWE-798 (hardcoded credentials) classification and the vendor 'Authentication Bypass' tag - the mechanism is use of undocumented built-in credentials, not a logic bypass; treat the CWE as authoritative.

An attacker who can reach an Apex NVR's management interface over the network uses the undocumented, hardcoded recovery credential - identical across all devices on the affected firmware - to authenticate to the password-reset workflow without any prior access. From that foothold they leverage the reset workflow and additional vulnerabilities to escalate toward administrative control of the video-surveillance recorder. No public exploit is identified at time of analysis, but the credential's static, unchangeable nature makes reliable reuse trivial once known.