EUVD-2026-23521CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionNVD
Anviz CX2 Lite is vulnerable to an authenticated command injection via a filename parameter that enables arbitrary command execution (e.g., starting telnetd), resulting in root‑level access.
AnalysisAI
Command injection in Anviz CX2 Lite firmware allows authenticated attackers with low-privilege network access to execute arbitrary OS commands as root by manipulating a filename parameter, enabling full device compromise including persistent backdoor installation (e.g., telnetd service). This ICS-focused access control device vulnerability was reported by ICS-CERT, indicating deployment in critical infrastructure environments. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all Anviz CX2 Lite devices in production and document firmware versions; restrict network access to these devices to named administrator accounts only. Within 7 days: Contact Anviz for patch availability and timeline; implement network segmentation isolating access control systems from general IT networks; disable unnecessary remote management protocols. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today