Technical impact
Anviz CrossChex Standard does not verify the source of communications between its client and server, allowing an attacker on the same local network to inject malicious TCP packets and alter or disrupt traffic. The flaw means that data sent by the client can be modified or replaced by an attacker with the same network address, potentially leading to unauthorized commands, data tampering, or denial of service to authorized users. The vulnerability is rooted in improper source authentication, classified as CWE-940.
Affected Systems
The affected system is Anviz CrossChex Standard. No specific version information is provided, so any deployment of the product that has not applied an identified fix may be vulnerable.
Risk and Exploitability
The CVSS score of 8.1 reflects a high severity level, indicating significant risk to confidentiality and integrity of the system’s communications. An attacker must be on the same network as the device to exploit the flaw, though the lack of source verification makes it straightforward to inject packets. The EPSS score is not available, so the exact exploitation probability is unknown, but the absence of a KEV listing suggests that a publicly known exploit has not yet been reported. Nonetheless, the high CVSS rating warrants immediate attention and mitigation.
