Anviz Devices Leak Remote Code Execution via Unverified Updates

The National Vulnerability Database has identified a critical flaw in Anviz CX2 Lite and CX7 devices, designated CVE-2026-40066. This vulnerability stems from the devices’ inability to properly verify software update packages. An attacker can upload a malicious script disguised as an update, which the device will then unpack and execute. This process allows for unauthenticated remote code execution, granting attackers significant control over the affected systems.

With a CVSS score of 8.8, this is a high-severity vulnerability. The attacker requires only low privileges to exploit it, and no user interaction is needed. The lack of product specification in the NVD entry is concerning; organizations deploying Anviz hardware should proactively inventory their assets. Defenders must assume that any unpatched Anviz CX2 Lite or CX7 device is a potential entry point for attackers.