Anviz CX2/CX7 Vulnerability: Unauthenticated Debug Access

The National Vulnerability Database has disclosed CVE-2026-40461, affecting Anviz CX2 Lite and CX7 devices. This high-severity vulnerability (CVSS 7.5) stems from unauthenticated POST requests that can modify debug settings. Attackers can exploit this to enable services like SSH without authorization.

This flaw, categorized as CWE-306 (Missing Authentication for Critical Function), allows for unauthorized state changes. The immediate danger is that an attacker can enable administrative access points, setting the stage for a full system compromise. It’s a critical pre-authentication vulnerability that bypasses security controls at the network edge.

For defenders, this means Anviz CX2 Lite and CX7 devices exposed to the network are at significant risk. Attackers are constantly scanning for such easily exploitable entry points. The ability to enable SSH unauthenticated dramatically lowers the bar for compromise, making these devices prime targets for initial access brokers and opportunistic attackers.