Anviz CX7 Firmware allows retrieval of test photos without requiring authentication, exposing sensitive operational imagery to anyone who can reach the device. This flaw represents a missing authorization weakness (CWE-862) and can lead to a confidentiality breach of captured images, as the attacker can view or capture internal photographs without permission.

The vulnerability is specific to Anviz CX7 firmware devices. No other vendors, products, or versions are known to be affected based on the current CNA data.

The CVSS score of 5.3 indicates a medium severity impact. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting lower immediate exploitation likelihood. However, without authentication, an attacker can access the photo endpoint remotely if the device is exposed to a network that can reach it. The lack of an official patch or work‑around from Anviz implies that the risk persists until the vendor provides a fix.