CVE-2026-32324 is a vulnerability in Anviz CX7 Firmware where the application embeds reusable certificate and cryptographic key material (CWE-321). This enables an attacker with local access to decrypt MQTT communication traffic and potentially manipulate device messaging channels. The vulnerability affects all versions of the firmware and has a CVSS 3.1 base score of 7.7, indicating high impact on confidentiality and integrity without requiring privileges or user interaction.

The vulnerability allows an attacker to decrypt sensitive MQTT traffic and interact with device messaging channels, compromising confidentiality and integrity of communications. This could lead to unauthorized access or control over device messaging functions. There is no indication of impact on availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor vendor communications for updates. Until a patch is available, limit local access to affected devices and restrict exposure of MQTT traffic to untrusted networks where possible.