Anviz CX2 Lite is vulnerable to an authenticated command injection via a
filename parameter that enables arbitrary command execution (e.g.,
starting telnetd), resulting in root‑level access.
References
| Link | Resource |
|---|---|
| https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-03.json | Third Party Advisory |
| https://www.anviz.com/contact-us.html | Product |
| https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-03 | US Government Resource |
Configurations
Configuration 1 (hide)
| AND |
|
History
04 May 2026, 14:31
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:anviz:cx2_lite_firmware:-:*:*:*:*:*:*:* cpe:2.3:h:anviz:cx2_lite:-:*:*:*:*:*:*:* |
|
| First Time |
Anviz cx2 Lite Firmware
Anviz Anviz cx2 Lite |
|
| References | () https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-03.json - Third Party Advisory | |
| References | () https://www.anviz.com/contact-us.html - Product | |
| References | () https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-03 - US Government Resource |
17 Apr 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-17 20:16
Updated : 2026-05-04 14:31
NVD link : CVE-2026-35682
Mitre link : CVE-2026-35682
CVE.ORG link : CVE-2026-35682
JSON object : View
Products Affected
anviz
- cx2_lite_firmware
- cx2_lite
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')