PT-2026-33496 · Anviz · Anviz Cx2 Lite Firmware+1

Published 2026-04-17 · Updated 2026-04-17 · CVE-2026-40461

Mitre

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug settings (e.g., enabling SSH), allowing unauthorized state changes that can facilitate later compromise.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-40461

Affected Products

Anviz Cx2 Lite Firmware

Anviz Cx7 Firmware

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-40461 · Security Note
• https://cisa.gov/news-events/ics-advisories/icsa-26-106-03 · Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-03.json · Note
• https://anviz.com/contact-us.html · Note