VulnerabilityAnalyzed
CVE-2026-33569
Anviz CX2 Lite and CX7 administrative sessions occur over HTTP, enabling on‑path attackers to sniff credentials and session data, which can be used to compromise the device.
MEDIUM 6.5EPSS 0.19%
Does this matter?
Lower severity and a low EPSS score (0.19%). Track it; it rarely justifies an emergency change on its own.
Description
Anviz CX2 Lite and CX7 administrative sessions occur over HTTP, enabling on‑path attackers to sniff credentials and session data, which can be used to compromise the device.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- EPSS
- 0.19% probability · 8th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-319
- Affected
- anviz/cx7 firmware · anviz/cx2 lite firmware
- Source
- ics-cert@hq.dhs.gov
References
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-03.jsonThird Party Advisory
- https://www.anviz.com/contact-us.htmlProduct
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-03US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.