EUVD-2026-23494CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionNVD
Anviz CX2 Lite and CX7 are vulnerable to unverified update packages that can be uploaded. The device unpacks and executes a script resulting in unauthenticated remote code execution.
AnalysisAI
Remote code execution in Anviz CX2 Lite and CX7 access control devices allows authenticated attackers to upload malicious firmware update packages that execute arbitrary scripts without verification. Reported by ICS-CERT, targeting physical access control systems commonly deployed in enterprise and critical infrastructure environments. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all Anviz CX2 Lite and CX7 devices in production and document network connectivity; restrict administrative access to these devices to essential personnel only and enforce strong password requirements. Within 7 days: Implement network segmentation to isolate affected access control devices from general IT infrastructure; disable remote administration features if operationally feasible; deploy enhanced monitoring for unexpected firmware modifications or administrative logins. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today