CVE Catalog
CVE-2026-40066
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk0.41%
35th percentile - higher than 35% of all known CVEs
Summary
Anviz CX2 Lite and CX7 devices are vulnerable to unverified update package uploads. The device unpacks and executes a script, leading to unauthenticated remote code execution.
Risk Assessment
An attacker can gain full control over the device, access the internal network, and potentially steal data or disrupt security systems.
Recommendation
Immediately block external access to the update interface, enforce authentication for all update operations, and contact the vendor for patches.
Other vulnerabilities in Anviz CX2 Lite and CX7
Original NVD description (English source)
Anviz CX2 Lite and CX7 are vulnerable to unverified update packages that can be uploaded. The device unpacks and executes a script resulting in unauthenticated remote code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS