OpenEye Apex NVR CVE-2026-92929

Requires the OpenEye Apex NVR's non-TLS web interface to be network-reachable by the attacker, and a security control that grants access based on local/loopback source address. The attacker exploits by supplying a crafted X-Forwarded-For header spoofing a loopback address (e.g., 127.0.0.1), which the firmware trusts as the request source. No authentication and no user interaction are required (PR:N/UI:N). Limiting factors: only affects firmware at/around 3.2.9.376 (design present since 2.2.3.4, fixed in 3.5.4), impact is confined to configuration information disclosure, and the appliance's web interface must be exposed to the attacker's network path.

This is a genuine but modest-severity issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3, MEDIUM) is internally consistent with the description: an unauthenticated remote attacker sends a spoofed X-Forwarded-For header, and the impact is confined to disclosure of configuration information (C:L only, no integrity or availability impact). CWE-290 (Authentication Bypass by Spoofing) accurately fits the described trust of a client-controlled header. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so there is no signal of active or automated exploitation. The realistic priority is LOW despite the network-reachable, unauthenticated nature: the payoff is limited to information disclosure on a niche video-surveillance appliance, and the vulnerable web interface must be exposed to the attacker. Note the vector describes a non-TLS interface and trivial header spoofing (AC:L, no user interaction), which makes exploitation easy where the appliance is network-reachable - the low priority comes from limited impact and narrow deployment, not from difficulty of exploitation.

An attacker with network access to an Apex NVR's non-TLS web interface sends an HTTP request containing a forged X-Forwarded-For header set to a loopback address (e.g., 127.0.0.1). The appliance trusts this header as the true source, treats the request as a local connection, and returns configuration information that is normally restricted to local-only access. No public exploit code was identified at time of analysis.