CVE-2026-33569

Anviz CX2 Lite and CX7 administrative sessions occur over HTTP, enabling on‑path attackers to sniff credentials and session data, which can be used to compromise the device.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-03.json	Third Party Advisory
https://www.anviz.com/contact-us.html	Product
https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-03	US Government Resource

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:anviz:cx7_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:anviz:cx7:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:anviz:cx2_lite_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:anviz:cx2_lite:-:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Las sesiones administrativas de Anviz CX2 Lite y CX7 ocurren a través de HTTP, lo que permite a atacantes en la ruta interceptar credenciales y datos de sesión, que pueden ser utilizados para comprometer el dispositivo.

Information

Published : 2026-04-17 20:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-33569

Mitre link : CVE-2026-33569

CVE.ORG link : CVE-2026-33569

JSON object : View

Products Affected

anviz

cx2_lite_firmware
cx2_lite
cx7_firmware
cx7

CWE

CWE-319

Cleartext Transmission of Sensitive Information

{"id": "CVE-2026-33569", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33569", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-17T20:32:31.417281Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "ics-cert@hq.dhs.gov", "affectedData": [{"vendor": "Anviz", "product": "Anviz CX7 Firmware", "versions": [{"status": "affected", "version": "All versions"}], "defaultStatus": "unaffected"}, {"vendor": "Anviz", "product": "Anviz CX2 Lite Firmware", "versions": [{"status": "affected", "version": "All versions"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-17T20:16:34.847", "references": [{"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-03.json", "tags": ["Third Party Advisory"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.anviz.com/contact-us.html", "tags": ["Product"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-03", "tags": ["US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-319"}]}], "descriptions": [{"lang": "en", "value": "Anviz\u00a0CX2 Lite and CX7 administrative sessions occur over HTTP, enabling \non\u2011path attackers to sniff credentials and session data, which can be \nused to compromise the device."}, {"lang": "es", "value": "Las sesiones administrativas de Anviz CX2 Lite y CX7 ocurren a trav\u00e9s de HTTP, lo que permite a atacantes en la ruta interceptar credenciales y datos de sesi\u00f3n, que pueden ser utilizados para comprometer el dispositivo."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:anviz:cx7_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "76C4D6EB-2046-4102-B450-4CF7FF2D2522"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:anviz:cx7:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "048A5AAF-E261-4EB3-899E-B5DC816C25D1"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:anviz:cx2_lite_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A731810-52F9-4ABC-86DF-DE47AE6DF8C8"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:anviz:cx2_lite:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "411BABCF-9FBA-4687-B23C-986A197EC996"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}