Unauthenticated firmware uploads on Anviz CX2 Lite and CX7 devices allow attackers to send crafted archives that the device accepts and executes as firmware. This flaw, identified as CWE‑306, can lead to arbitrary code execution and the establishment of a reverse shell, enabling full compromise of the system.

The affected products are Anviz CX2 Lite Firmware and Anviz CX7 Firmware. Specific version details are not provided in the advisory, so all firmware revisions of these devices may be vulnerable.

The CVSS score of 9.8 indicates a critical severity. With no EPSS score available and the vulnerability not listed in KEV, exploitation likelihood is uncertain, but the lack of authentication combined with the ability to plant malicious code makes the attack vector highly dangerous. The probable attack path involves an attacker sending a malicious firmware package over the local network or to an exposed update interface, which is then processed without authentication, leading to system compromise.