Anviz CX7 Firmware embeds a reusable certificate/key material (CWE‑321), meaning the same cryptographic key is stored in every firmware image. This hard‑coded key enables decryption of MQTT traffic, and the advisory notes the possibility of interacting with device messaging channels at scale; thus confidentiality, integrity, and potentially control of the device are at risk.

The affected system is the Anviz CX7 device running firmware that contains the reusable key material. No specific firmware version was identified, so any current build that has not yet been patched may be vulnerable until a corrected version is released.

With a CVSS score of 7.7 the flaw is moderate to high severity. The EPSS score of less than 1% indicates a low but nonzero probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Because the key is embedded in the firmware, an attacker who can locate and extract it — a possibility implied by the hard‑coded nature of the key — could decrypt intercepted MQTT traffic. This inference regarding the ease of key extraction is drawn from the description, not stated explicitly in the advisory.