CVE-2026-35546

CVE-2026-35546 is a critical vulnerability affecting Anviz CX2 Lite and CX7 devices that allows unauthenticated attackers to upload malicious firmware through crafted archives, potentially leading to remote code execution and reverse shell access. The vulnerability carries a CVSS score of 9.8 (Critical) due to its network-accessible attack vector, low complexity, lack of authentication requirements, and high impact across confidentiality, integrity, and availability. The attack requires no user interaction and can be executed by a remote, unauthenticated attacker with minimal effort. While exploitation data is currently limited with an EPSS score of 0.00078 and no confirmed Common Vulnerabilities and Exposures (KEV) catalog inclusion, the vulnerability is actively tracked on threat intelligence hot lists, warranting immediate attention. Organizations deploying these Anviz devices should prioritize patching or implementing network-level access controls to restrict firmware upload functionality pending vendor remediation.