CVE-2026-40066: Anviz CX2 Lite Firmware

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Anviz CX2 Lite and CX7 are vulnerable to unverified update packages that can be uploaded. The device unpacks and executes a script resulting in unauthenticated remote code execution.

Affected products

• Anviz CX2 Lite Firmware: affected versions not specified
• Anviz CX7 Firmware: affected versions not specified

Published 2026-04-17. Last modified 2026-07-10.