CVE-2026-92929

Name of the Vulnerable Software and Affected Versions OpenEye Apex Network Video Recorder versions 2.2.3.4 through 3.2.9.376

Description The software trusts an X-Forwarded-For header provided by a client to determine the request source address. This allows an unauthenticated remote attacker to spoof a loopback address and bypass security controls that restrict access to local connections on non-TLS web interfaces, leading to the disclosure of configuration information.

Recommendations Upgrade to version 3.5.4.