Anviz CX2 Lite and CX7 devices allow any user to upload firmware update packages without verifying integrity, a flaw identified as CWE-494 – Download of Code Without Integrity Check. The firmware file, once unpacked, automatically executes a script embedded in the package, resulting in unauthenticated remote code execution and giving an attacker full control of the device.

The affected products are the Anviz CX2 Lite Firmware and the Anviz CX7 Firmware, as identified by the vendor. No other product versions are listed as vulnerable in the current advisory.

The CVSS score of 8.8 classifies the vulnerability as high severity. EPSS data indicates a very low exploitation probability (< 1 %), and the issue is not listed in the CISA KEV catalog. Because no authentication is required, an attacker can upload a malicious firmware package that the device will unpack and execute, yielding remote code execution and complete device compromise.