Unauthenticated access to Anviz CX2 Lite and CX7 devices can reveal debug configuration details such as SSH and RTTY status. This exposure allows an attacker to gather information useful for later reconnaissance or attacks, but does not directly grant control of the device. The weakness is a missing authorization check (CWE-862).

The affected vendors and products are Anviz CX2 Lite Firmware and Anviz CX7 Firmware. No specific version ranges are listed in the advisory, so all current and prior releases of these firmware families should be considered potentially vulnerable until a vendor patch is available.

The CVSS score of 5.3 classifies the issue as medium severity, and the EPSS score of 0.00028 (less than 1%) indicates a very low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Because the description does not specify how the unauthenticated access is performed, the attack vector is inferred to be remote/network based; however, no exploit code or proof‑of‑concept is cited in the advisory.