CVE-2026-35546 Anviz Products Missing Authentication for Critical Function
CriticalCVSS 9.8
EPSS 0.60%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This causes crafted
archives to be accepted, enabling attackers to plant and execute code
and obtain a reverse shell.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Anviz CX7 Firmware | = All versions | No fix listed |
| Anviz CX2 Lite Firmware | = All versions | No fix listed |
| Anviz cx7 firmware | All versions | No fix listed |
| Anviz cx2 lite firmware | All versions | No fix listed |
References
- www.anviz.com product
- www.cisa.gov us-government-resource
- github.com third-party-advisory