Anviz Cx2 Lite Firmware vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Anviz Cx2 Lite Firmware: 6 record(s), with affected versions and fixes.
cpe:2.3:o:anviz:cx2_lite_firmware

CVE-2026-40461 High · 7.5 CWE-306 Apr 17, 2026

Anviz Products Missing Authentication for Critical Function

Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug settings (e.g., enabling SSH), allowing unauthorized state changes that can facilitate later compromise.

CVE-2026-40066 High · 8.8 CWE-494 Apr 17, 2026

Anviz Products Download of Code Without Integrity Check

Anviz CX2 Lite and CX7 are vulnerable to unverified update packages that can be uploaded. The device unpacks and executes a script resulting in unauthenticated remote code execution.

CVE-2026-35682 High · 8.8 CWE-77 Apr 17, 2026

Anviz CX2 Lite Command Injection

Anviz CX2 Lite is vulnerable to an authenticated command injection via a filename parameter that enables arbitrary command execution (e.g., starting telnetd), resulting in root‑level access.

CVE-2026-35546 Critical · 9.8 CWE-306 Apr 17, 2026

Anviz Products Missing Authentication for Critical Function

Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This causes crafted archives to be accepted, enabling attackers to plant and execute code and obtain a reverse shell.

CVE-2026-33569 Medium · 6.5 CWE-319 Apr 17, 2026

Anviz Products Cleartext Transmission of Sensitive Information

Anviz CX2 Lite and CX7 administrative sessions occur over HTTP, enabling on‑path attackers to sniff credentials and session data, which can be used to compromise the device.

CVE-2026-32648 Medium · 5.3 CWE-862 Apr 17, 2026

Anviz Products Missing Authorization

Anviz CX2 Lite and CX7 are vulnerable to unauthenticated access that discloses debug configuration details (e.g., SSH/RTTY status), assisting attackers in reconnaissance against the device.