CVE-2026-40066
Anviz CX2 Lite and CX7 are vulnerable to unverified update packages that can be uploaded.
Published Apr 17, 2026 · updated Jul 10, 2026 · anviz cx7 firmware
Anviz CX2 Lite and CX7 are vulnerable to unverified update packages that can be uploaded. The device unpacks and executes a script resulting in unauthenticated remote code execution.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 17, 2026 · NIST NVD
Detected
Anviz CX2 Lite and CX7 are vulnerable to unverified update packages that can be uploaded. The device unpacks and executes a script resulting in unauthenticated remote code execution.
Jul 10, 2026 · NIST NVD
Updated
Anviz CX2 Lite and CX7 are vulnerable to unverified update packages that can be uploaded. The device unpacks and executes a script resulting in unauthenticated remote code execution.
Affected
- cpe anviz/cx2 lite firmwareversion unspecified
- cpe anviz/cx7 firmwareversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-40066
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-40066
Anviz CX2 Lite and CX7 are vulnerable to unverified update packages that can be uploaded. The device unpacks and executes a script resulting in unauthenticated remote code execution.
nvd.nist.gov