CVE-2026-92928

Name of the Vulnerable Software and Affected Versions OpenEye Apex Network Video Recorder versions 2.2.3.4 through 3.2.9.376

Description The firmware contains a hardcoded, undocumented recovery account with shared credentials that cannot be modified, disabled, or rotated. An unauthenticated remote attacker can utilize this account to authenticate to the password-reset workflow. This account does not grant standard administrator access, and further vulnerabilities would be necessary to achieve a full administrator takeover.

Recommendations Upgrade to version 3.5.4.