CVE-2026-40461
Anviz Products Missing Authentication for Critical Function
- State
- Published
- Severity
- 7.5 High
- Published
- Apr 17, 2026
- Updated
- Apr 17, 2026
- Reserved
- Apr 14, 2026
Description
Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug settings (e.g., enabling SSH), allowing unauthorized state changes that can facilitate later compromise.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | icscert |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Anviz CX7 FirmwareAnviz |
|
Anviz CX2 Lite FirmwareAnviz |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.