CVE-2026-32324 PUBLISHED

Anviz CX7 Firmware Use of Hard-coded Cryptographic Key

Assigner: icscert
Reserved: 14.04.2026 Published: 17.04.2026 Updated: 17.04.2026

Anviz CX7 Firmware is vulnerable because the application embeds reusable certificate/key material, enabling decryption of MQTT traffic and potential interaction with device messaging channels at scale.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS Score: 7.7

Attack Vector	Local	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Anviz
Product	Anviz CX7 Firmware
Versions	Default: unaffected Version All versions is affected

Workarounds

Anviz did not respond to CISA's attempts to coordinate these vulnerabilities. Users should contact Anviz for more information at https://www.anviz.com/contact-us.html.

References

Problem Types

CWE-321 Use of Hard-coded Cryptographic Key CWE