OpenEye Apex NVR EUVD-2026-84984

Requires physical console access to the OpenEye Apex NVR AND access to the privileged administrator password-reset workflow. The core enabling condition is that the unlock-code design uses no per-device secret or server-side cryptographic material, allowing a valid code to be computed offline. Limiting factors: exploitation is physical-only (AV:P) - there is no network or remote vector - and needs interaction with the privileged reset workflow, so it is not remotely or automatically exploitable. Applies to firmware from at least 2.2.3.4 through 3.2.9.376; upgrading to 3.5.4 remediates it.

The vendor CVSS of 6.2 (CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) is driven up by full C:H/I:H/A:H impact (administrator takeover) but heavily constrained by AV:P (physical) and PR:H - the attacker must be at the device console AND already have access to the privileged password-reset workflow. This is a real design flaw (CWE-330: no per-device secret, so an unlock code can be forged offline), and the note that it has existed since firmware 2.2.3.4 means a large installed base is affected, but the physical + privileged-access precondition makes it a targeted, hands-on-device issue rather than a scalable remote threat. No EPSS score, no CISA KEV listing, and no public POC are present in the input; exploitation status is therefore 'no public exploit identified at time of analysis.' Net: this is a genuine defect for physical-security-sensitive deployments (an NVR is itself a physical-security device), but it is a low-to-moderate operational priority compared with remotely exploitable flaws. One caveat to verify with the vendor: PR:H alongside a password-reset primitive is slightly contradictory - the purpose of resetting is usually to gain access one lacks - so confirm exactly what privilege the reset workflow itself requires.

An attacker with physical access to an OpenEye Apex NVR reaches the console and invokes the privileged administrator password-reset workflow. Because the unlock code is derived without any per-device secret or server-side cryptographic material, the attacker computes a valid code entirely offline and submits it to reset the administrator password, seizing full control of the recorder. No public exploit code is identified in the provided data; exploitation requires hands-on physical access.