CVE-2026-40461

HighCVSS 7.5

Published: 17/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that can modify debug settings, such as enabling SSH.

Risk Assessment

This can lead to unauthorized state changes, creating a risk of later system compromise.

Recommendation

It is recommended to secure devices against unauthorized requests and to monitor debug settings.

Other vulnerabilities in Anviz CX2 Lite, Anviz CX7

CVE-2026-35546Critical
Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This allows attackers to upload crafted archives, leading to the execution of code and obtaining a reverse shell.

Original NVD description (English source)

Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug settings (e.g., enabling SSH), allowing unauthorized state changes that can facilitate later compromise.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS