CVE-2026-40066: CWE-494 in Anviz Anviz CX7 Firmware
Anviz CX2 Lite and CX7 are vulnerable to unverified update packages that can be uploaded. The device unpacks and executes a script resulting in unauthenticated remote code execution.
AI Analysis
Technical Summary
CVE-2026-40066 is a vulnerability in Anviz CX2 Lite and CX7 firmware where the device accepts update packages without verifying their authenticity. The firmware unpacks and executes a script contained within the update package, enabling unauthenticated remote code execution. This vulnerability is classified under CWE-494 (Download of Code Without Integrity Check). The vulnerability affects all versions of the Anviz CX7 firmware. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.
Potential Impact
Successful exploitation allows an unauthenticated attacker to remotely execute arbitrary code on the affected device, potentially leading to full compromise of the device's functionality and confidentiality, integrity, and availability impacts. Given the high CVSS score (8.8), the impact is severe.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device to trusted sources only and monitor for suspicious update attempts. Avoid applying update packages from untrusted sources.
CVE-2026-40066: CWE-494 in Anviz Anviz CX7 Firmware
Description
Anviz CX2 Lite and CX7 are vulnerable to unverified update packages that can be uploaded. The device unpacks and executes a script resulting in unauthenticated remote code execution.
CVSS v3.1
Score 8.8high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-40066 is a vulnerability in Anviz CX2 Lite and CX7 firmware where the device accepts update packages without verifying their authenticity. The firmware unpacks and executes a script contained within the update package, enabling unauthenticated remote code execution. This vulnerability is classified under CWE-494 (Download of Code Without Integrity Check). The vulnerability affects all versions of the Anviz CX7 firmware. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.
Potential Impact
Successful exploitation allows an unauthenticated attacker to remotely execute arbitrary code on the affected device, potentially leading to full compromise of the device's functionality and confidentiality, integrity, and availability impacts. Given the high CVSS score (8.8), the impact is severe.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device to trusted sources only and monitor for suspicious update attempts. Avoid applying update packages from untrusted sources.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- icscert
- Date Reserved
- 2026-04-14T15:47:54.264Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69e28fa4bdfbbecc59867cbc
Added to database: 04/17/2026, 19:53:08 UTC
Last enriched: 07/11/2026, 07:55:48 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 154
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.