CVE-2026-40066 describes a vulnerability in Anviz CX2 Lite and CX7 firmware where the devices accept unverified update packages. These packages contain scripts that the device unpacks and executes without authentication, leading to remote code execution. The vulnerability is classified under CWE-494 (Download of Code Without Integrity Check). It affects all versions of the Anviz CX7 firmware. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published by the vendor as of the data provided.

Successful exploitation allows an unauthenticated attacker to remotely execute arbitrary code on the affected device. This can lead to full compromise of the device, including potential disruption of device functionality and unauthorized access to sensitive data. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected devices to trusted sources only and monitor for unusual update package activity. Avoid applying update packages from untrusted sources. Follow vendor communications closely for any forthcoming patches or mitigations.