CVE-2026-33569: Anviz CX2 Lite/CX7 Info Disclosure Flaw

CVE-2026-33569 Overview

CVE-2026-33569 is a cleartext transmission vulnerability affecting Anviz CX2 Lite and CX7 devices. Administrative sessions on these devices occur over HTTP instead of HTTPS, enabling on-path attackers to sniff credentials and session data. This cleartext transmission of sensitive authentication information can be exploited to compromise the affected devices entirely.

Critical Impact

Attackers positioned on the network path can intercept administrative credentials and session tokens, potentially gaining full control over access control systems.

Affected Products

• Anviz CX2 Lite
• Anviz CX7
• Anviz access control devices with HTTP-based administrative interfaces

Discovery Timeline

• 2026-04-17 - CVE-2026-33569 published to NVD
• 2026-04-20 - Last updated in NVD database

Technical Details for CVE-2026-33569

Vulnerability Analysis

This vulnerability is classified as CWE-319 (Cleartext Transmission of Sensitive Information). The Anviz CX2 Lite and CX7 devices transmit administrative credentials and session data over unencrypted HTTP connections. This fundamental security flaw exposes all authentication exchanges to potential interception by any attacker with network visibility between the administrator and the device.

The network-based attack vector requires no privileges on the target system but does require the victim to access the administrative interface while the attacker has visibility into the network traffic. The primary impact is confidentiality loss, as intercepted credentials provide unauthorized access to device administration functions.

Root Cause

The root cause of this vulnerability is the lack of transport layer encryption for administrative sessions. The affected Anviz devices use HTTP protocol for their web-based administrative interfaces instead of implementing HTTPS with TLS/SSL encryption. This design decision fails to protect sensitive data in transit, violating fundamental security principles for authentication systems.

Attack Vector

Exploitation requires the attacker to be in an on-path position between the legitimate administrator and the Anviz device. Common attack scenarios include:

• ARP spoofing on local network segments to redirect traffic through the attacker's system
• Rogue access point attacks in wireless environments
• Compromised network infrastructure such as switches or routers
• Man-in-the-middle positioning through DNS poisoning or BGP hijacking

Once positioned, the attacker can passively capture HTTP traffic containing administrative credentials, session cookies, and other sensitive configuration data. Standard packet capture tools such as Wireshark or tcpdump can be used to extract this information from unencrypted traffic streams.

Detection Methods for CVE-2026-33569

Indicators of Compromise

• Unauthorized administrative sessions or configuration changes on Anviz CX2 Lite or CX7 devices
• Unusual network traffic patterns such as ARP anomalies or duplicate MAC addresses
• Evidence of credential reuse or login attempts from unexpected IP addresses
• Configuration modifications not initiated by authorized personnel

Detection Strategies

• Monitor network traffic for unencrypted HTTP sessions to Anviz device administrative ports
• Implement ARP spoofing detection mechanisms on network switches
• Deploy network intrusion detection systems (NIDS) to identify man-in-the-middle attack patterns
• Review device access logs for authentication anomalies or suspicious session activity

Monitoring Recommendations

• Enable logging on Anviz devices and forward logs to a centralized SIEM platform
• Configure network monitoring to alert on HTTP traffic to device administrative interfaces
• Implement network segmentation monitoring to detect lateral movement attempts
• Audit administrative access patterns and flag deviations from baseline behavior

How to Mitigate CVE-2026-33569

Immediate Actions Required

• Isolate affected Anviz CX2 Lite and CX7 devices on a dedicated, segmented network
• Restrict administrative access to trusted management networks only
• Implement VPN or SSH tunneling for remote administrative access
• Monitor for signs of credential theft or unauthorized device access

Patch Information

Contact Anviz support for firmware updates that may address this vulnerability. Review the CISA ICS Advisory ICSA-26-106-03 for the latest vendor guidance and remediation information. Technical details are also available in the GitHub CSAF File.

Workarounds

• Place affected devices behind a reverse proxy that terminates HTTPS and proxies to the HTTP interface
• Implement strict network segmentation to limit exposure of device traffic
• Use dedicated management VLANs with access control lists restricting connectivity
• Consider deploying network-level encryption such as IPsec for device communication paths

# Network segmentation example using iptables
# Restrict administrative access to management network only
iptables -A INPUT -p tcp --dport 80 -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP