CVEs (6)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
1Anviz 2Cx2 Lite Firmware Cx7 FirmwareJun 17, 2026 Apr 17, 2026 N/A· v4 7.5 HIGH· v3 N/A· v2 Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug
settings (e.g., enabling SSH), allowing unauthorized state changes that
can facilitate later compromise. |
1Anviz 2Cx2 Lite Firmware Cx7 FirmwareJul 10, 2026 Apr 17, 2026 N/A· v4 8.8 HIGH· v3 N/A· v2 Anviz CX2 Lite and CX7 are vulnerable to unverified update packages that can be uploaded. The device unpacks and executes a script resulting in unauthenticated remote code execution. |
Anviz CX2 Lite is vulnerable to an authenticated command injection via a
filename parameter that enables arbitrary command execution (e.g.,
starting telnetd), resulting in root‑level access. |
1Anviz 2Cx2 Lite Firmware Cx7 FirmwareJun 17, 2026 Apr 17, 2026 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This causes crafted
archives to be accepted, enabling attackers to plant and execute code
and obtain a reverse shell. |
1Anviz 2Cx2 Lite Firmware Cx7 FirmwareJun 17, 2026 Apr 17, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Anviz CX2 Lite and CX7 administrative sessions occur over HTTP, enabling
on‑path attackers to sniff credentials and session data, which can be
used to compromise the device. |
1Anviz 2Cx2 Lite Firmware Cx7 FirmwareJun 17, 2026 Apr 17, 2026 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Anviz CX2 Lite and CX7 are vulnerable to unauthenticated access that discloses debug
configuration details (e.g., SSH/RTTY status), assisting attackers in
reconnaissance against the device. |