CVE-2026-31927 is a path traversal vulnerability in Anviz CX7 Firmware that arises from insufficient validation of file paths during an authenticated CSV upload process. This allows an attacker with authentication privileges to overwrite arbitrary files on the device filesystem, including critical system files like /etc/shadow. Successful exploitation combined with changes to debug settings can lead to unauthorized SSH access. The vulnerability affects all versions of the Anviz CX7 Firmware and has a CVSS 3.1 base score of 4.9 (medium severity). No vendor patch or official remediation has been published as of the data provided.

An attacker with authenticated access can overwrite arbitrary files on the device, potentially compromising system integrity and enabling unauthorized SSH access. This could lead to privilege escalation or persistent unauthorized control of the device. However, exploitation requires valid credentials and additional configuration changes to enable SSH access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated user access to trusted personnel only and monitor for unusual file modifications or configuration changes. Avoid uploading CSV files from untrusted sources. Follow vendor channels for updates on patches or official mitigations.