Anviz CX2 Lite and CX7 Unauthenticated Remote Code Execution Vulnerability

A vulnerability exists in Anviz CX2 Lite and CX7 devices, allowing unverified update packages to be uploaded. The devices unpack and execute a script from these packages, leading to unauthenticated remote code execution.

Impact

Exploitation of this vulnerability could result in unauthorized remote code execution on the affected devices.

Remediation

Anviz did not respond to CISA's attempts to coordinate these vulnerabilities. Users should contact Anviz for more information through their official contact page.