Anviz CX7 Firmware is vulnerable to an authenticated CSV upload which allows path traversal
to overwrite arbitrary files (e.g., /etc/shadow), enabling unauthorized
SSH access when combined with debug‑setting changes
References
| Link | Resource |
|---|---|
| https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-03.json | Third Party Advisory |
| https://www.anviz.com/contact-us.html | Product |
| https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-03 | US Government Resource |
Configurations
Configuration 1 (hide)
| AND |
|
History
04 May 2026, 14:32
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Anviz cx7
Anviz cx7 Firmware Anviz |
|
| CPE | cpe:2.3:o:anviz:cx7_firmware:-:*:*:*:*:*:*:* cpe:2.3:h:anviz:cx7:-:*:*:*:*:*:*:* |
|
| References | () https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-03.json - Third Party Advisory | |
| References | () https://www.anviz.com/contact-us.html - Product | |
| References | () https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-03 - US Government Resource |
17 Apr 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-17 20:16
Updated : 2026-05-04 14:32
NVD link : CVE-2026-31927
Mitre link : CVE-2026-31927
CVE.ORG link : CVE-2026-31927
JSON object : View
Products Affected
anviz
- cx7
- cx7_firmware
CWE
CWE-23
Relative Path Traversal