Anviz Devices Exposed: Critical Firmware Upload Vulnerability Allows Remote Code Execution

The National Vulnerability Database has detailed a critical flaw, CVE-2026-35546, impacting Anviz CX2 Lite and CX7 devices. This vulnerability, rated CVSS 9.8, allows unauthenticated attackers to upload crafted archives. Successful exploitation enables the planting and execution of arbitrary code, ultimately leading to a reverse shell and full system compromise.

This is a wide-open door. The lack of authentication on firmware uploads is a fundamental security failure. Attackers can leverage this to gain persistent access, exfiltrate sensitive data, or use the compromised device as a pivot point into the wider network. Given the critical severity and ease of exploitation (CVSS vector indicates Network exploitability with no privileges or user interaction required), immediate action is paramount.