CVE-2026-40066

CVE-2026-40066 affects Anviz CX2 Lite and CX7 devices through an unverified update package upload vulnerability that enables unauthenticated remote code execution. The flaw allows attackers to upload malicious update packages that the devices automatically unpack and execute without proper verification mechanisms. This vulnerability carries a CVSS score of 8.8 (HIGH) with a network-based attack vector requiring low complexity and low privileges, resulting in complete compromise of confidentiality, integrity, and availability. The vulnerability is currently listed on the active Hot List, indicating heightened community attention and ongoing monitoring, though it is not yet widely exploited based on EPSS metrics. Organizations running affected Anviz devices should prioritize patching efforts given the high severity rating and unauthenticated nature of the attack vector.