{"schema_version":1,"title":"Anviz Cx2 Lite vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 6 vulnerabilities in Anviz Cx2 Lite: 0 in the last 7 days and 0 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-40461, was published on 17 April 2026.","url":"https://junglewise.ai/threats/technologies/cx2-lite","json_url":"https://junglewise.ai/threats/technologies/cx2-lite.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/cx2-lite","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":true,"counts":{"high":3,"all_time":6,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":0,"last_365_days":6},"latest":[{"cve":"CVE-2026-40461","cvss":7.5,"epss":0.0029,"slug":"cve-2026-40461-anviz-cx2-lite-and-cx7-are-vulnerable-to-unauthenticated-post","title":"Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug settings (e.g., enabling…","severity":"high","exploited":false,"published_at":"2026-04-17T20:16:36.217+00:00","url":"https://junglewise.ai/threats/cve-2026-40461-anviz-cx2-lite-and-cx7-are-vulnerable-to-unauthenticated-post"},{"cve":"CVE-2026-40066","cvss":8.8,"epss":0.003,"slug":"cve-2026-40066-anviz-cx2-lite-and-cx7-remote-code-execution-via-unverified","title":"Anviz CX2 Lite and CX7 remote code execution via unverified updates","severity":"high","exploited":false,"published_at":"2026-04-17T20:16:35.637+00:00","url":"https://junglewise.ai/threats/cve-2026-40066-anviz-cx2-lite-and-cx7-remote-code-execution-via-unverified"},{"cve":"CVE-2026-35682","cvss":8.8,"epss":0.0179,"slug":"cve-2026-35682-anviz-cx2-lite-is-vulnerable-to-an-authenticated-command","title":"Anviz CX2 Lite is vulnerable to an authenticated command injection via a filename parameter that enables arbitrary command execution (e.g.","severity":"high","exploited":false,"published_at":"2026-04-17T20:16:35.51+00:00","url":"https://junglewise.ai/threats/cve-2026-35682-anviz-cx2-lite-is-vulnerable-to-an-authenticated-command"},{"cve":"CVE-2026-35546","cvss":9.8,"epss":0.0059,"slug":"cve-2026-35546-anviz-cx2-lite-and-cx7-are-vulnerable-to-unauthenticated-firmware","title":"Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This causes crafted archives to be…","severity":"critical","exploited":false,"published_at":"2026-04-17T20:16:35.38+00:00","url":"https://junglewise.ai/threats/cve-2026-35546-anviz-cx2-lite-and-cx7-are-vulnerable-to-unauthenticated-firmware"},{"cve":"CVE-2026-33569","cvss":6.5,"epss":0.0019,"slug":"cve-2026-33569-anviz-cx2-lite-and-cx7-administrative-sessions-occur-over-http","title":"Anviz CX2 Lite and CX7 administrative sessions occur over HTTP, enabling on‑path attackers to sniff credentials and…","severity":"medium","exploited":false,"published_at":"2026-04-17T20:16:34.847+00:00","url":"https://junglewise.ai/threats/cve-2026-33569-anviz-cx2-lite-and-cx7-administrative-sessions-occur-over-http"},{"cve":"CVE-2026-32648","cvss":5.3,"epss":0.0025,"slug":"cve-2026-32648-anviz-cx2-lite-and-cx7-are-vulnerable-to-unauthenticated-access","title":"Anviz CX2 Lite and CX7 are vulnerable to unauthenticated access that discloses debug configuration details (e.g…","severity":"medium","exploited":false,"published_at":"2026-04-17T20:16:34.22+00:00","url":"https://junglewise.ai/threats/cve-2026-32648-anviz-cx2-lite-and-cx7-are-vulnerable-to-unauthenticated-access"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Anviz Cx7","slug":"cx7","vulnerabilities":9,"url":"https://junglewise.ai/threats/technologies/cx7"},{"name":"Anviz CX7 Firmware","slug":"cx7-firmware","vulnerabilities":9,"url":"https://junglewise.ai/threats/technologies/cx7-firmware"},{"name":"Anviz CX2 Lite Firmware","slug":"cx2-lite-firmware","vulnerabilities":6,"url":"https://junglewise.ai/threats/technologies/cx2-lite-firmware"}],"technology":{"hub":true,"name":"Anviz Cx2 Lite","slug":"cx2-lite","vendor":{"hub":true,"name":"Anviz","slug":"anviz","url":"https://junglewise.ai/threats/vendors/anviz"},"aliases":[],"homepage":"https://www.anviz.com/product/cx2-lite-face-recognition-time-attendance.html","description":"A compact fingerprint and RFID access control terminal.","url":"https://junglewise.ai/threats/technologies/cx2-lite"},"most_severe":[{"cve":"CVE-2026-35546","cvss":9.8,"epss":0.0059,"slug":"cve-2026-35546-anviz-cx2-lite-and-cx7-are-vulnerable-to-unauthenticated-firmware","title":"Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This causes crafted archives to be…","severity":"critical","exploited":false,"published_at":"2026-04-17T20:16:35.38+00:00","url":"https://junglewise.ai/threats/cve-2026-35546-anviz-cx2-lite-and-cx7-are-vulnerable-to-unauthenticated-firmware"},{"cve":"CVE-2026-35682","cvss":8.8,"epss":0.0179,"slug":"cve-2026-35682-anviz-cx2-lite-is-vulnerable-to-an-authenticated-command","title":"Anviz CX2 Lite is vulnerable to an authenticated command injection via a filename parameter that enables arbitrary command execution (e.g.","severity":"high","exploited":false,"published_at":"2026-04-17T20:16:35.51+00:00","url":"https://junglewise.ai/threats/cve-2026-35682-anviz-cx2-lite-is-vulnerable-to-an-authenticated-command"},{"cve":"CVE-2026-40066","cvss":8.8,"epss":0.003,"slug":"cve-2026-40066-anviz-cx2-lite-and-cx7-remote-code-execution-via-unverified","title":"Anviz CX2 Lite and CX7 remote code execution via unverified updates","severity":"high","exploited":false,"published_at":"2026-04-17T20:16:35.637+00:00","url":"https://junglewise.ai/threats/cve-2026-40066-anviz-cx2-lite-and-cx7-remote-code-execution-via-unverified"},{"cve":"CVE-2026-40461","cvss":7.5,"epss":0.0029,"slug":"cve-2026-40461-anviz-cx2-lite-and-cx7-are-vulnerable-to-unauthenticated-post","title":"Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug settings (e.g., enabling…","severity":"high","exploited":false,"published_at":"2026-04-17T20:16:36.217+00:00","url":"https://junglewise.ai/threats/cve-2026-40461-anviz-cx2-lite-and-cx7-are-vulnerable-to-unauthenticated-post"},{"cve":"CVE-2026-33569","cvss":6.5,"epss":0.0019,"slug":"cve-2026-33569-anviz-cx2-lite-and-cx7-administrative-sessions-occur-over-http","title":"Anviz CX2 Lite and CX7 administrative sessions occur over HTTP, enabling on‑path attackers to sniff credentials and…","severity":"medium","exploited":false,"published_at":"2026-04-17T20:16:34.847+00:00","url":"https://junglewise.ai/threats/cve-2026-33569-anviz-cx2-lite-and-cx7-administrative-sessions-occur-over-http"},{"cve":"CVE-2026-32648","cvss":5.3,"epss":0.0025,"slug":"cve-2026-32648-anviz-cx2-lite-and-cx7-are-vulnerable-to-unauthenticated-access","title":"Anviz CX2 Lite and CX7 are vulnerable to unauthenticated access that discloses debug configuration details (e.g…","severity":"medium","exploited":false,"published_at":"2026-04-17T20:16:34.22+00:00","url":"https://junglewise.ai/threats/cve-2026-32648-anviz-cx2-lite-and-cx7-are-vulnerable-to-unauthenticated-access"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}