CVE-2026-40461 - Anviz Products Missing Authentication for Critical Function

Back Back to CVE browser

HIGH

Anviz Products Missing Authentication for Critical Function

Published Apr 17, 2026

7.5

HIGH

CVSS 3.1

EPSS 0.48%

Description

Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug settings (e.g., enabling SSH), allowing unauthorized state changes that can facilitate later compromise.

Affected products

Vendor Anviz Product Anviz CX2 Lite Firmware Default
unaffected
- Version
  All versions
  Status
  affected
  Constraints
  -
Vendor Anviz Product Anviz CX7 Firmware Default
unaffected
- Version
  All versions
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Anviz

Anviz CX2 Lite Firmware

unaffected

Version	Status	Constraints
All versions	affected	-

Anviz

Anviz CX7 Firmware

unaffected

Version	Status	Constraints
All versions	affected	-

Remediation

Vendor solution

Anviz did not respond to CISA's attempts to coordinate these vulnerabilities. Users should contact Anviz for more information at https://www.anviz.com/contact-us.html.

Weaknesses (1)

CWE-306

Missing Authentication

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-23498
Advisory
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-03.json
Third Party Advisory
https://www.anviz.com/contact-us.html
Product
https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-03
US Government Resource

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-23498		Advisory
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-03.json		Third Party Advisory
https://www.anviz.com/contact-us.html		Product
https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-03		US Government Resource