CVE-2026-33569 describes a vulnerability in Anviz CX7 firmware where administrative sessions occur over unencrypted HTTP. This allows network attackers to sniff credentials and session data, potentially compromising the device. The vulnerability affects all versions of the firmware and is categorized under CWE-319 (Cleartext Transmission of Sensitive Information). The CVSS 3.1 base score is 6.5 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, no integrity or availability impact. No patch or official remediation guidance is currently available.

An attacker with network access can intercept administrative credentials and session data transmitted in cleartext over HTTP. This can lead to unauthorized access and compromise of the affected Anviz CX7 devices. The confidentiality of administrative credentials is at high risk, but integrity and availability are not directly impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict network access to the device's administrative interface to trusted networks only and avoid using untrusted or public networks for administration. Consider using network-level encryption such as VPNs to protect administrative sessions.