CVE-2026-40461

CVE-2026-40461 affects Anviz CX2 Lite and CX7 devices, which contain an authentication bypass vulnerability allowing unauthenticated users to submit POST requests that modify debug settings, including enabling SSH access. This flaw enables attackers to alter device configuration without proper credentials, potentially establishing persistence mechanisms for subsequent compromise. The vulnerability carries a HIGH CVSS score of 7.5, with a network-based attack vector requiring no authentication or user interaction, though it does not directly impact confidentiality. Exploitation status indicates this vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog and shows minimal community attention, with an EPSS score of 0.00035 suggesting low real-world exploitation prevalence. Organizations operating Anviz CX2 Lite or CX7 devices should prioritize patching to mitigate the risk of unauthorized debug feature activation and potential lateral movement within their networks.