Anviz CX2 Lite and CX7 are vulnerable to unverified update packages that can be uploaded. The
device unpacks and executes a script resulting in unauthenticated remote
code execution.
Anviz did not respond to CISA's attempts to coordinate these
vulnerabilities. Users should contact Anviz for more information at
https://www.anviz.com/contact-us.html.