Anviz CX2 Lite and CX7 administrative sessions occur over HTTP, allowing attackers to sniff credentials and session data. This cleartext transmission of sensitive information can lead to a compromise of the device, enabling an attacker to obtain administrative control. The weakness is CWE‑319, which directly threatens confidentiality by exposing authentication data.

The vulnerability affects Anviz CX2 Lite Firmware and Anviz CX7 Firmware. Users of these products should be aware that management interfaces are unsecured and may allow traffic interception.

The CVSS score of 6.5 reflects moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation data. The likely attack vector is an on‑path network sniffing scenario where an attacker can read traffic between an administrator and the device. Once credentials are captured, an attacker can maintain persistent control over the device.