CVE-2026-32648 describes a vulnerability in all versions of Anviz CX7 firmware (including CX2 Lite) where unauthenticated users can access debug configuration details without authorization. This includes sensitive information like SSH and RTTY status, which could assist attackers in further targeting the device. The vulnerability is classified under CWE-862, indicating missing authorization checks. The CVSS score of 5.3 reflects a medium severity with network attack vector, low attack complexity, and no privileges or user interaction required. No vendor patch or official remediation level has been published yet.

The vulnerability allows unauthenticated attackers to obtain debug configuration information from affected devices. While this does not directly compromise confidentiality, integrity, or availability, it provides valuable reconnaissance data that could facilitate subsequent attacks. There are no known active exploits reported, and the impact is limited to information disclosure of debug settings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to affected devices to trusted users only and monitor for unauthorized access attempts. Avoid exposing these devices directly to untrusted networks.