CVE-2026-40066: Anviz CX2 Lite/CX7 RCE Vulnerability

CVE-2026-40066 Overview

CVE-2026-40066 is a firmware vulnerability affecting Anviz CX2 Lite and CX7 access control devices that allows attackers to upload unverified update packages. When processed, the device unpacks and executes malicious scripts, resulting in unauthenticated remote code execution. This vulnerability is classified as CWE-494 (Download of Code Without Integrity Check), indicating that the affected devices fail to verify the authenticity or integrity of firmware updates before executing them.

This vulnerability is particularly concerning for organizations using these devices in physical access control systems, as successful exploitation could allow attackers to gain persistent access to security infrastructure, manipulate access controls, or use compromised devices as a pivot point for lateral movement within the network.

Critical Impact

Unauthenticated attackers can achieve remote code execution on Anviz access control devices by uploading malicious update packages, potentially compromising physical security infrastructure.

Affected Products

• Anviz CX2 Lite Access Control Device
• Anviz CX7 Access Control Device

Discovery Timeline

• 2026-04-17 - CVE-2026-40066 published to NVD
• 2026-04-20 - Last updated in NVD database

Technical Details for CVE-2026-40066

Vulnerability Analysis

The vulnerability stems from insufficient integrity verification in the firmware update mechanism of Anviz CX2 Lite and CX7 devices. When an update package is uploaded to the device, the system processes and executes contained scripts without verifying cryptographic signatures or validating the source of the update. This design flaw allows attackers with network access to craft malicious update packages that, once uploaded, execute arbitrary code with the privileges of the update process—typically root or system-level access on embedded devices.

Access control devices like the CX2 Lite and CX7 are typically deployed in security-sensitive environments such as office buildings, data centers, and restricted areas. Compromise of these devices could enable attackers to bypass physical security controls, extract credential data, or establish persistent backdoor access to the target network.

Root Cause

The root cause of this vulnerability is the absence of code integrity verification (CWE-494) in the firmware update process. The affected Anviz devices accept and process update packages without validating cryptographic signatures, checksums, or other integrity mechanisms that would ensure the update originates from a trusted source. This allows any attacker who can reach the device's update interface to upload arbitrary code for execution.

Attack Vector

The attack leverages network access to the device's update functionality. An attacker constructs a malicious update package containing a script payload. Upon upload to the vulnerable device, the firmware update handler unpacks the package and executes the embedded script without verification. This grants the attacker code execution capabilities on the device, potentially allowing full device compromise, configuration manipulation, or establishment of persistent access.

The vulnerability is exploitable over the network and requires low privileges to execute. The following steps outline the general attack flow:

1. Attacker identifies a vulnerable Anviz CX2 Lite or CX7 device on the network
2. Attacker crafts a malicious update package containing exploit code
3. The package is uploaded to the device via the update interface
4. The device unpacks and executes the malicious script without verification
5. Attacker achieves remote code execution on the device

For technical details on this vulnerability, refer to the CISA ICS Advisory ICSA-26-106-03.

Detection Methods for CVE-2026-40066

Indicators of Compromise

• Unexpected firmware update activity or update logs showing unauthorized package uploads
• Unusual outbound network connections from access control devices to unknown external hosts
• Modified system files or configuration changes on Anviz devices not aligned with authorized maintenance
• Presence of unexpected scripts or executables in the device firmware or temporary directories

Detection Strategies

• Monitor network traffic to and from Anviz access control devices for suspicious update package transfers
• Implement network segmentation and firewall rules to restrict access to device management interfaces
• Deploy intrusion detection systems (IDS) with rules to detect anomalous firmware update attempts
• Audit device logs regularly for unauthorized access attempts or unexpected configuration changes

Monitoring Recommendations

• Enable and centralize logging for all Anviz access control devices to a SIEM platform
• Configure alerts for firmware update events occurring outside of scheduled maintenance windows
• Monitor for unusual authentication patterns or failed login attempts on device interfaces
• Track network connections from IoT/OT segments for connections to unexpected destinations

How to Mitigate CVE-2026-40066

Immediate Actions Required

• Isolate affected Anviz CX2 Lite and CX7 devices from untrusted networks immediately
• Restrict network access to device management and update interfaces to authorized personnel only
• Contact Anviz via their support contact page to inquire about security patches or firmware updates
• Conduct a security audit of existing device configurations and firmware versions

Patch Information

As of the last update on 2026-04-20, specific patch information has not been published in the CVE data. Organizations should monitor the CISA ICS Advisory ICSA-26-106-03 for updates and contact Anviz directly for remediation guidance. Additionally, the GitHub CSAF Document may contain additional technical details and remediation information.

Workarounds

• Implement network segmentation to isolate access control devices from general network traffic
• Deploy firewall rules to block unauthorized access to device update and management interfaces
• Use VPN or other secure channels for any required remote management of affected devices
• Disable remote update functionality if possible until a vendor patch is available
• Implement network access control (NAC) to restrict which systems can communicate with vulnerable devices

# Example firewall configuration to restrict access to device management interface
# Restrict management access to specific IP range only
iptables -A INPUT -p tcp --dport 80 -s 192.168.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP