CVE-2026-35546CWE-306

Anviz Products Missing Authentication for Critical Function

Critical · published April 17, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
56.6
In the wild
Unconfirmed
What it is

Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This causes crafted

archives to be accepted, enabling attackers to plant and execute code

and obtain a reverse shell.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00815 · 56.6th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-04-17T19:39Z
EPSS history
Timeline
  • 17 APR 19:39Z
    Anviz Products Missing Authentication for Critical Function
    cvelistv5