CVE-2026-40461 is a vulnerability in Anviz CX2 Lite and CX7 firmware that permits unauthenticated attackers to send POST requests to modify debug settings, including enabling SSH access. This lack of authentication for critical functions (CWE-306) allows unauthorized users to change device state, potentially enabling further attacks. The vulnerability affects all firmware versions and has a high CVSS score of 7.5 due to its ease of exploitation (network accessible, no privileges or user interaction required) and impact on integrity. No vendor patch or official remediation is currently documented.

The vulnerability allows an unauthenticated attacker to alter debug settings on affected devices, such as enabling SSH access, which can lead to unauthorized control or further compromise. While confidentiality is not impacted, the integrity of the device's configuration is at high risk. Availability is not affected. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit network exposure of affected devices and monitor for unauthorized configuration changes. Avoid exposing these devices directly to untrusted networks. Follow vendor communications for updates on patches or mitigations.