high8.8
CVE-2026-40066
Anviz CX2 Lite and CX7 are vulnerable to unverified update packages that can be uploaded.
Impact
Anviz CX2 Lite and CX7 are vulnerable to unverified update packages that can be uploaded. The device unpacks and executes a script resulting in unauthenticated remote code execution.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Anviz | Cx7 Firmware | All versions |
| Anviz | Cx2 Lite Firmware | All versions |