# CVE-2026-40066: Anviz CX2 Lite and CX7 remote code execution via unverified updates

Source: https://junglewise.ai/threats/cve-2026-40066-anviz-cx2-lite-and-cx7-remote-code-execution-via-unverified  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-17. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-40066 · Severity: high · CVSS 8.8 · Published 2026-04-17

Anviz CX2 Lite and CX7 facial recognition and time attendance devices are vulnerable to a security flaw in their update mechanism. An attacker can upload a malicious update package that the device will automatically unpack and execute. This allows an attacker to take full control of the device, potentially disrupting physical access control or stealing sensitive data.

Technologies: [Anviz Cx2 Lite](https://junglewise.ai/threats/technologies/cx2-lite), [Anviz Cx2 Lite Firmware](https://junglewise.ai/threats/technologies/cx2-lite-firmware), [Anviz Cx7](https://junglewise.ai/threats/technologies/cx7), [Anviz Cx7 Firmware](https://junglewise.ai/threats/technologies/cx7-firmware). Vendors: [Anviz](https://junglewise.ai/threats/vendors/anviz).

## Quick answers

**Is CVE-2026-40066 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40066 being exploited in the wild.

**How severe is CVE-2026-40066?** High severity, with a CVSS score of 8.8, published 17 April 2026.

**Which products and versions are affected?** Anviz Cx2 Lite Firmware All versions; Anviz Cx7 Firmware All versions.

**Is there a fix for CVE-2026-40066?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-40066 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-40066?** Check whether you run Anviz Cx2 Lite, Anviz Cx2 Lite Firmware, Anviz Cx7 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Anviz CX2 Lite and CX7 firmware versions are vulnerable to CWE-494 (Download of Code Without Integrity Check). The devices allow the upload of update packages that are not properly verified for authenticity or integrity. Upon upload, the device automatically unpacks the package and executes contained scripts. This flaw enables an attacker with network access to achieve remote code execution (RCE) with high privileges. While the CVSS vector indicates low privileges are required, the summary describes the result as unauthenticated RCE. As of the advisory date, the vendor has not provided a patch, and users are advised to contact Anviz for support.

## Affected products

- Anviz CX2 Lite Firmware All versions
- Anviz CX7 Firmware All versions

## Timeline

- 2026-04-16: advisory: CISA published ICSA-26-106-03
- 2026-04-17: disclosed: CVE-2026-40066 published in NVD

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-03.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-03.json)
- [https://www.anviz.com/contact-us.html](https://www.anviz.com/contact-us.html)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-03](https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-03)

## Related threats

- [Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug settings (e.g., enabling…](https://junglewise.ai/threats/cve-2026-40461-anviz-cx2-lite-and-cx7-are-vulnerable-to-unauthenticated-post)
- [Anviz CX2 Lite is vulnerable to an authenticated command injection via a filename parameter that enables arbitrary command execution (e.g.](https://junglewise.ai/threats/cve-2026-35682-anviz-cx2-lite-is-vulnerable-to-an-authenticated-command)
- [Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This causes crafted archives to be…](https://junglewise.ai/threats/cve-2026-35546-anviz-cx2-lite-and-cx7-are-vulnerable-to-unauthenticated-firmware)
- [Anviz CX7 Firmware is vulnerable to the most recently captured test photo that can be retrieved without…](https://junglewise.ai/threats/cve-2026-35061-anviz-cx7-firmware-is-vulnerable-to-the-most-recently-captured)
- [Anviz CX2 Lite and CX7 administrative sessions occur over HTTP, enabling on‑path attackers to sniff credentials and…](https://junglewise.ai/threats/cve-2026-33569-anviz-cx2-lite-and-cx7-administrative-sessions-occur-over-http)