Anviz CX2 Lite firmware is vulnerable to an authenticated command injection via a filename parameter that allows an attacker to execute arbitrary system commands, such as starting the telnet daemon, thereby achieving root‑level control. This flaw provides full remote code execution capabilities against the affected device. The vulnerability stems from improper handling of user‑supplied filenames, classified as CWE‑77.

The affected product is the Anviz CX2 Lite firmware. No specific version information is listed in the CNA data.

The CVSS score of 8.8 indicates a high severity, while no EPSS value is available and the issue is not listed in the CISA KEV catalog. The flaw requires authenticated access to the device’s management interface to supply the malicious filename. The attack vector is likely the network interface that accepts file upload or management commands. Given the high severity but uncertain exploitation probability, the risk is significant for exposed devices, especially those reachable via public or untrusted networks.