CVE-2026-33093 is a vulnerability in Anviz CX7 Firmware where the device accepts unauthenticated POST requests that trigger the front-facing camera to capture images. This lack of authorization (CWE-862) allows an attacker without credentials to obtain visual information from the device's surroundings. The vulnerability affects all firmware versions and has a CVSS 3.1 base score of 5.3 (medium severity), with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No vendor advisory or patch information is currently available.

An attacker can remotely capture images from the front-facing camera without authentication, potentially exposing sensitive visual information about the environment where the device is deployed. There is no indication of impact on integrity or availability. The confidentiality impact is limited to visual data exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the device to trusted users and networks to reduce exposure. Monitor for unusual POST requests targeting the device's camera functionality.