CVE-2026-40461CWE-306
Anviz Products Missing Authentication for Critical Function
High · published April 17, 2026
What it is
Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug
settings (e.g., enabling SSH), allowing unauthorized state changes that
can facilitate later compromise.
The record
Technical detail
- CVSS v3.1
- 7.5 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00482 · 40.6th percentile
- Weakness
- CWE-306 · Missing Authentication for Critical Function
- Published
- 2026-04-17T19:36Z
EPSS history
Timeline