CVE-2026-40434: Anviz Crosschex Standard DOS Vulnerability

CVE-2026-40434 Overview

Anviz CrossChex Standard contains a flaw in its client/server communication channel that fails to verify the source of incoming TCP packets. An attacker on the same network segment can inject crafted TCP packets to alter or disrupt application traffic between the CrossChex client and server. The weakness is classified under CWE-940 (Improper Verification of Source of a Communication Channel) and was published in the CISA ICS Advisory icsa-26-106-03. CrossChex Standard is widely deployed as the management software for Anviz biometric access control and time attendance devices, making this an operational technology concern.

Critical Impact
An adjacent-network attacker can inject TCP packets into the CrossChex client/server channel to modify access control data, tamper with attendance records, or disrupt availability of the management software.

Affected Products

Anviz CrossChex Standard (all versions per CPE cpe:2.3:a:anviz:crosschex_standard:-:*:*:*:*:*:*:*)
Anviz biometric access control devices managed through CrossChex Standard
Anviz time and attendance hardware paired with CrossChex Standard

Discovery Timeline

2026-04-17 - CVE-2026-40434 published to NVD
2026-04-17 - CISA publishes ICS Advisory icsa-26-106-03
2026-05-04 - Last updated in NVD database

Technical Details for CVE-2026-40434

Vulnerability Analysis

The vulnerability resides in how CrossChex Standard handles TCP traffic between the management client and its server endpoint. The protocol implementation does not authenticate the origin of received packets. Any host on the same broadcast or routed adjacent network can craft TCP segments that the application accepts as legitimate. This places the integrity and availability of the management channel at the mercy of any device that can reach it at the network layer.

CrossChex Standard typically synchronizes user records, fingerprint templates, and access events between biometric terminals and the management server. Without source verification, an attacker can spoof either endpoint of a session. The result is forged commands, manipulated records, or denial of service against the management workflow. The attack is limited to the adjacent network, which constrains remote exploitation but does not prevent insider abuse, rogue device scenarios, or compromise from a foothold inside a flat OT network.

Root Cause

The root cause is the absence of cryptographic or session-bound source validation on the TCP channel. The application trusts packets that match an expected session and sequence without verifying their authenticity through mutual authentication, transport layer security, or message integrity codes. This maps directly to CWE-940, where a communication channel is established without ensuring the peer is the intended party.

Attack Vector

Exploitation requires network adjacency to the CrossChex client or server, such as a position on the same VLAN or subnet. The attacker observes or predicts session parameters and then injects TCP packets carrying crafted CrossChex protocol messages. Successful injection can rewrite attendance entries, suppress alerts, push commands to attached biometric readers, or terminate the session. No user interaction or prior authentication is required. The vulnerability does not expose confidential data directly, but it compromises integrity and availability of access control operations. Refer to the CISA ICS Advisory icsa-26-106-03 and the GitHub CSAF Document for the authoritative technical write-up.

Detection Methods for CVE-2026-40434

Indicators of Compromise

Unexpected modifications to attendance logs, user records, or door-unlock events that do not correlate with operator activity.
Duplicate or out-of-sequence TCP segments on the CrossChex management port between known clients and the server.
Connection resets or session terminations on the CrossChex channel without corresponding application-side activity.
Unknown MAC or IP addresses on the OT VLAN that hosts CrossChex devices.

Detection Strategies

Deploy network intrusion detection signatures that flag TCP sequence anomalies, duplicate ACKs, and unexpected RST packets on the CrossChex management port.
Enable deep packet inspection on the OT segment to baseline CrossChex protocol exchanges and alert on deviations from the learned profile.
Correlate CrossChex application audit logs with network flow data to identify record changes that lack a matching authenticated client session.

Monitoring Recommendations

Capture and retain full packet data on the VLAN carrying CrossChex traffic for forensic replay.
Monitor ARP tables and DHCP leases on the OT segment to detect rogue hosts capable of staging adjacent-network injection.
Alert on any new device that initiates TCP sessions to the CrossChex server outside the approved client inventory.

How to Mitigate CVE-2026-40434

Immediate Actions Required

Contact Anviz through the Anviz Contact Information page to obtain status on a vendor-supplied patch or hardened build.
Place CrossChex servers and biometric terminals on a dedicated, isolated VLAN with strict access control lists limiting traffic to known management workstations.
Restrict physical and logical access to the OT network so that only authorized devices can reach the CrossChex management channel.
Review CrossChex audit logs for unexplained record changes since the system was deployed.

Patch Information

At the time of publication, no fixed version is referenced in the CISA ICS Advisory icsa-26-106-03. Operators should track the advisory for updates and engage Anviz directly through the Anviz Contact Information page to confirm remediation availability.

Workarounds

Encapsulate CrossChex client/server traffic inside an IPsec or TLS tunnel between trusted endpoints to provide source authentication that the application lacks.
Use switch port security, 802.1X, and private VLANs to prevent unauthorized hosts from gaining adjacency to CrossChex devices.
Disable or firewall CrossChex management ports on any interface that is not strictly required for client connectivity.
Implement static ARP entries on CrossChex servers and clients to reduce the effectiveness of adjacent-network spoofing.

bash

# Example: restrict CrossChex management port to a defined client subnet on Linux
iptables -A INPUT -p tcp --dport 5050 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 5050 -j DROP

# Example: enforce static ARP for the CrossChex server on a Windows client
netsh interface ipv4 add neighbors "Ethernet" 10.20.30.10 aa-bb-cc-dd-ee-ff