CVE-2026-35546 Anviz CVE debrief

Who should care

Organizations that deploy or administer Anviz CX2 Lite or CX7 devices, especially teams responsible for remote access, device management, physical security, or industrial/operational environments where these devices are network-reachable.

Technical summary

The advisory describes an authentication bypass in firmware upload handling: unauthenticated attackers can submit crafted firmware archives that the device accepts. The impact is full remote compromise of the affected device, including arbitrary code execution and reverse-shell access. CISA lists the issue as CVSS v3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network exploitable, low-complexity, no-authentication compromise with high confidentiality, integrity, and availability impact.

Defensive priority

Immediate. Treat as a critical network-exploitable RCE affecting deployed devices and prioritize isolation, exposure reduction, and vendor mitigation or replacement planning.

Recommended defensive actions

• Identify whether any Anviz CX2 Lite or CX7 devices are in use, including any firmware versions covered by the advisory.
• Reduce or eliminate network exposure to management and firmware-upload interfaces; place affected devices behind restrictive segmentation and access controls.
• Contact Anviz for remediation guidance using the vendor contact listed in the advisory and apply any available firmware or configuration fixes as soon as they are provided.
• Monitor devices and associated management systems for unexpected firmware-upload activity, configuration changes, reboot events, and other signs of unauthorized access.
• If immediate patching is not available, consider temporary compensating controls such as tight allowlisting, management-plane isolation, and removal of unnecessary remote access paths.
• Follow CISA industrial control system recommended practices for defense-in-depth, backups, and incident response preparation.

Evidence notes

Primary facts come from the CISA CSAF advisory ICSA-26-106-03 (CVE-2026-35546), published 2026-04-16. The advisory states that CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads, that crafted archives can be accepted, and that this can enable code execution and a reverse shell. The supplied corpus also records CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). CISA notes that Anviz did not respond to coordination attempts and directs users to contact Anviz for more information. No KEV entry or ransomware-campaign association is present in the supplied corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.