CVE-2026-35546

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35546", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2026-04-14T15:47:54.234Z", "datePublished": "2026-04-17T19:39:25.110Z", "dateUpdated": "2026-04-17T20:05:28.411Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-04-17T19:39:25.110Z"}, "title": "Anviz Products Missing Authentication for Critical Function", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-306", "description": "CWE-306", "type": "CWE"}]}], "affected": [{"vendor": "Anviz", "product": "Anviz CX7 Firmware", "versions": [{"status": "affected", "version": "All versions"}], "defaultStatus": "unaffected"}, {"vendor": "Anviz", "product": "Anviz CX2 Lite Firmware", "versions": [{"status": "affected", "version": "All versions"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Anviz\u00a0CX2 Lite and CX7\u00a0are vulnerable to unauthenticated firmware uploads. This causes crafted \narchives to be accepted, enabling attackers to plant and execute code \nand obtain a reverse shell.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This causes crafted \narchives to be accepted, enabling attackers to plant and execute code \nand obtain a reverse shell."}]}], "references": [{"url": "https://www.anviz.com/contact-us.html"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-03"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-03.json"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "workarounds": [{"lang": "en", "value": "Anviz did not respond to CISA's attempts to coordinate these \nvulnerabilities. Users should contact Anviz for more information at \nhttps://www.anviz.com/contact-us.html.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Anviz did not respond to CISA's attempts to coordinate these \nvulnerabilities. Users should contact Anviz for more information at \nhttps://www.anviz.com/contact-us.html."}]}], "source": {"advisory": "ICSA-26-106-03", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-17T20:05:03.369768Z", "id": "CVE-2026-35546", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-17T20:05:28.411Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35546", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-17T20:05:03.369768Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-17T20:05:18.682Z"}}], "cna": {"title": "Anviz Products Missing Authentication for Critical Function", "source": {"advisory": "ICSA-26-106-03", "discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Anviz", "product": "Anviz CX7 Firmware", "versions": [{"status": "affected", "version": "All versions"}], "defaultStatus": "unaffected"}, {"vendor": "Anviz", "product": "Anviz CX2 Lite Firmware", "versions": [{"status": "affected", "version": "All versions"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.anviz.com/contact-us.html"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-03"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-03.json"}], "workarounds": [{"lang": "en", "value": "Anviz did not respond to CISA's attempts to coordinate these \nvulnerabilities. Users should contact Anviz for more information at \nhttps://www.anviz.com/contact-us.html.", "supportingMedia": [{"type": "text/html", "value": "Anviz did not respond to CISA's attempts to coordinate these \nvulnerabilities. Users should contact Anviz for more information at \nhttps://www.anviz.com/contact-us.html.", "base64": false}]}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Anviz\u00a0CX2 Lite and CX7\u00a0are vulnerable to unauthenticated firmware uploads. This causes crafted \narchives to be accepted, enabling attackers to plant and execute code \nand obtain a reverse shell.", "supportingMedia": [{"type": "text/html", "value": "Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This causes crafted \narchives to be accepted, enabling attackers to plant and execute code \nand obtain a reverse shell.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-04-17T19:39:25.110Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35546", "state": "PUBLISHED", "dateUpdated": "2026-04-17T20:05:28.411Z", "dateReserved": "2026-04-14T15:47:54.234Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2026-04-17T19:39:25.110Z", "assignerShortName": "icscert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Anviz CX7 Firmware", "vendor": "Anviz", "versions": [{"status": "affected", "version": "All versions"}]}, {"defaultStatus": "unaffected", "product": "Anviz CX2 Lite Firmware", "vendor": "Anviz", "versions": [{"status": "affected", "version": "All versions"}]}], "source": "ics-cert@hq.dhs.gov"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:anviz:cx7_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "76C4D6EB-2046-4102-B450-4CF7FF2D2522", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:anviz:cx7:-:*:*:*:*:*:*:*", "matchCriteriaId": "048A5AAF-E261-4EB3-899E-B5DC816C25D1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:anviz:cx2_lite_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "2A731810-52F9-4ABC-86DF-DE47AE6DF8C8", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:anviz:cx2_lite:-:*:*:*:*:*:*:*", "matchCriteriaId": "411BABCF-9FBA-4687-B23C-986A197EC996", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Anviz\u00a0CX2 Lite and CX7\u00a0are vulnerable to unauthenticated firmware uploads. This causes crafted \narchives to be accepted, enabling attackers to plant and execute code \nand obtain a reverse shell."}, {"lang": "es", "value": "Anviz CX2 Lite y CX7 son vulnerables a cargas de firmware no autenticadas. Esto provoca que se acepten archivos especialmente dise\u00f1ados, lo que permite a los atacantes insertar y ejecutar c\u00f3digo y obtener una shell inversa."}], "id": "CVE-2026-35546", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35546", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-17T20:05:03.369768Z", "version": "2.0.3"}}]}, "published": "2026-04-17T20:16:35.380", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory"], "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-03.json"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Product"], "url": "https://www.anviz.com/contact-us.html"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["US Government Resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-03"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "anviz_cx2_lite_firmware", "vendor": "anviz"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "anviz_cx7_firmware", "vendor": "anviz"}], "analysis": {"en": {"generated_at": "2026-04-18T09:05:12.207755+00:00", "value": {"mitigation_remediation": ["Contact Anviz to obtain a firmware patch or formal fix.", "Restrict or disable the firmware upload interface so only trusted networks can access it.", "Segment the device from untrusted networks and monitor for unexpected firmware update activity."], "summary": {"action": "Contact Vendor", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The affected products are Anviz CX2 Lite Firmware and Anviz CX7 Firmware. Specific version details are not provided in the advisory, so all firmware revisions of these devices may be vulnerable.", "description_and_impact": "Unauthenticated firmware uploads on Anviz CX2 Lite and CX7 devices allow attackers to send crafted archives that the device accepts and executes as firmware. This flaw, identified as CWE\u2011306, can lead to arbitrary code execution and the establishment of a reverse shell, enabling full compromise of the system.", "risk_and_exploitability": "The CVSS score of 9.8 indicates a critical severity. With no EPSS score available and the vulnerability not listed in KEV, exploitation likelihood is uncertain, but the lack of authentication combined with the ability to plant malicious code makes the attack vector highly dangerous. The probable attack path involves an attacker sending a malicious firmware package over the local network or to an exposed update interface, which is then processed without authentication, leading to system compromise."}}}}, "created": "2026-04-18T09:15:15.964458+00:00", "updated": "2026-04-20T14:59:44.405997+00:00", "vendors": ["anviz", "anviz$PRODUCT$anviz_cx2_lite_firmware", "anviz$PRODUCT$anviz_cx7_firmware"]}