Anviz CX2 Lite Vulnerable to Root-Level Command Injection

The National Vulnerability Database has disclosed CVE-2026-35682, a high-severity authenticated command injection vulnerability affecting Anviz CX2 Lite devices. This flaw, rated 8.8 CVSS, stems from improper handling of the filename parameter, allowing an authenticated attacker to execute arbitrary commands, such as initiating telnetd.

This isn’t just a theoretical bug; it’s a direct path to root-level access. Once an attacker gains authenticated access—which could be via stolen credentials, weak default passwords, or another vulnerability—they can fully compromise the device. This provides a persistent foothold and potential pivot point into the broader network.

For defenders, this means Anviz CX2 Lite devices, often deployed in physical security or access control systems, represent a critical attack surface. A compromise here could lead to physical security bypasses or lateral movement into IT infrastructure, making it a high-value target for sophisticated attackers.