What is the CVSS score of CVE-2026-33093?

CVE-2026-33093 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Anviz Cx7 Firmware CVE-2026-33093

EUVD-2026-23480 MEDIUM

Missing Authorization (CWE-862)

2026-04-17 icscert

GHSA-vh49-38wc-6wqp

Authentication Bypass Anviz Cx7 Firmware

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 17, 2026 - 20:05 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 19:45 euvd

EUVD-2026-23480

Analysis Generated

Apr 17, 2026 - 19:45 vuln.today

CVE Published

Apr 17, 2026 - 19:17 nvd

MEDIUM 5.3

DescriptionCVE.org

Anviz CX7 Firmware is vulnerable to an unauthenticated POST to the device that captures a photo with the front facing camera, exposing visual information about the deployment environment.

AnalysisAI

Unauthenticated remote attackers can capture photos using the front-facing camera on Anviz CX7 devices via a direct POST request, exposing visual information about the physical deployment environment without authentication. The vulnerability affects all versions of Anviz CX7 Firmware and is tracked in CISA industrial control systems advisories, indicating deployment in operational technology environments. With a CVSS score of 5.3 (network-accessible, no authentication required, low complexity), this represents a confidentiality breach suitable for reconnaissance or social engineering in sensitive facilities.

Technical ContextAI

Anviz CX7 is a biometric access control device commonly deployed in physical security systems and operational technology environments. The vulnerability stems from an authentication bypass (CWE-862: Missing Authorization) in the device's REST API or web service layer. The firmware exposes an endpoint that accepts unauthenticated POST requests to trigger camera functionality, typically used for authorized personnel enrollment or legitimate surveillance but here unprotected by access controls. The affected product runs on embedded firmware (CPE indicates all versions of anviz_cx7_firmware), meaning the vulnerability is likely baked into the device's boot image and difficult to remediate without full firmware replacement. The device's front-facing camera-designed for biometric capture and identity verification-becomes a reconnaissance tool when the authorization check is missing.

RemediationAI

Contact Anviz through https://www.anviz.com/contact-us.html to obtain a patched firmware version addressing the authentication bypass. Immediately restrict network access to Anviz CX7 management interfaces by implementing strict network segmentation: place devices on a dedicated VLAN with access controls allowing only authorized management stations and block all unauthenticated access from general network segments or the Internet. Disable or restrict the camera capture API endpoint at the firewall or through any device-level access control lists if the management interface supports granular feature disabling. For interim protection, physically isolate devices on a management-only network without spanning to operational networks, though this limits device usability and is not a long-term solution. Review device logs (if available) for unauthorized POST requests to camera endpoints to identify potential prior reconnaissance. Once a patched firmware version is released by Anviz, prioritize its deployment to all CX7 devices, especially those in sensitive facilities.