CVE-2026-35546 is a critical vulnerability in Anviz CX7 and CX2 Lite firmware that allows unauthenticated attackers to upload malicious firmware images. The flaw stems from improper authentication controls (CWE-306) on the firmware upload mechanism, permitting crafted archives to be accepted by the device. Successful exploitation enables arbitrary code execution and remote shell access, compromising device integrity and confidentiality. All firmware versions are affected, and no official fix or mitigation has been disclosed by Anviz as of the publication date.

An attacker can exploit this vulnerability to execute arbitrary code on affected devices without any authentication, leading to full compromise including remote shell access. This can result in loss of device control, data confidentiality, and availability. Given the critical CVSS score of 9.8, the impact on affected systems is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the firmware upload interface to trusted administrators only and monitor for unauthorized firmware upload attempts. Avoid exposing the device management interfaces to untrusted networks.