What is GHSA-2h86-6hmv-8f46?

GHSA-2h86-6hmv-8f46 is a security advisory published by GitHub Security Advisories with Medium severity. OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcoded, undocumented...

Which CVE IDs does GHSA-2h86-6hmv-8f46 cover?

GHSA-2h86-6hmv-8f46 covers the following CVE IDs: CVE-2026-92928. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2h86-6hmv-8f46?

GHSA-2h86-6hmv-8f46 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-2h86-6hmv-8f46MediumCVSS 6.5

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcoded, undocumented...

Vendor

GitHub Security Advisories

Published

September 23, 2026

Last Modified

September 23, 2026

🔗 CVE IDs covered (1)

CVE-2026-92928 →

📋 Description

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled, or rotated. An unauthenticated remote attacker can use the account to authenticate to the password-reset workflow. The account does not provide normal administrator access; additional vulnerabilities are required to obtain an administrator takeover. The underlying design has been present since at least firmware 2.2.3.4.

Upgrade to version 3.5.4.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-92928
https://portal.openeye.net/updates/issue-alerts/1058
https://www.securifera.com/advisories
https://github.com/advisories/GHSA-2h86-6hmv-8f46