# Critical Authentication Bypass Vulnerabilities Expose Anviz Access Control Systems to Unauthorized Compromise


Anviz, a manufacturer of biometric and access control devices deployed across critical infrastructure worldwide, faces a severe security crisis following the disclosure of multiple critical vulnerabilities affecting its most popular product lines. The flaws collectively expose organizations using these systems to reconnaissance, credential theft, unauthorized access, and complete device compromise—yet the vendor has remained silent on remediation efforts.


The U.S. Cybersecurity and Infrastructure Security Agency (CISA) identified a chain of missing authentication and authorization defects affecting the CX2 Lite, CX7, and CrossChex Standard product families. With CVSS severity scores ranging from 5.3 to 9.8, and all firmware versions reported as vulnerable, the vulnerability set represents an immediate threat to deployed installations in commercial facilities, manufacturing plants, government agencies, hospitals, financial institutions, and energy sectors.


Most concerning: Anviz declined to participate in CISA's coordinated vulnerability disclosure process, leaving organizations without official patched firmware or documented mitigation strategies.


## The Threat Landscape


The disclosed vulnerabilities operate as a progression of attack vectors, each enabling subsequent compromise stages. An attacker without any credentials can:


  • Capture live camera feeds directly from devices positioned at building entrances
  • Retrieve historical images stored on the system
  • Extract debugging configuration data that exposes SSH and remote terminal services
  • Enable previously disabled access methods by modifying device settings remotely
  • Upload malicious firmware that gains persistent, root-level code execution

    • This attack progression transforms what should be a secure physical access control system into an open door for unauthorized facility access, surveillance, and infrastructure reconnaissance.


    ## Detailed Vulnerability Analysis


    ### Unauthenticated Reconnaissance and Surveillance


    CVE-2026-33093 and CVE-2026-35061 allow attackers to extract visual information from the CX7 device without any authentication. The first permits real-time photo capture through an unauthenticated POST request; the second retrieves previously captured test images stored on the device.


    For facilities using these devices at entry points, this translates to unauthorized surveillance capabilities—an attacker can monitor who enters and exits a building, observe security procedures, or identify badge holders without triggering any alarm.


    ### Configuration Disclosure Enabling Further Attack


    CVE-2026-32648 exposes debug configuration data including SSH and remote terminal (RTTY) service status. This reconnaissance capability arms attackers with knowledge of what administrative access methods are available, which services are active, and what debug features might be exploitable.


    Paired with CVE-2026-40461, attackers can not only discover these services exist but also enable them remotely. This vulnerability allows unauthenticated POST requests to modify debug settings—effectively turning on SSH access or other administrative backdoors that the organization may have assumed were disabled.


    ### Direct Code Execution via Multiple Paths


    CVE-2026-35682 demonstrates a command injection flaw in the CX2 Lite affecting authenticated users. By injecting special characters through a filename parameter, attackers can execute arbitrary system commands with root privileges. This could enable launching a telnet daemon for persistent backdoor access or executing reconnaissance commands against internal networks.


    More critically, CVE-2026-35546 allows completely unauthenticated firmware uploads to both CX2 Lite and CX7 devices. An attacker can upload a crafted firmware archive that bypasses integrity verification (an integrity check is entirely absent or improperly implemented), execute arbitrary code during the installation process, and obtain a reverse shell connecting back to attacker infrastructure.


    ### Supporting Vulnerabilities


    Additional disclosed flaws include hardcoded cryptographic keys, algorithm downgrade attacks during negotiation, cleartext transmission of sensitive data, and relative path traversal vulnerabilities. Each of these weaknesses either enables or facilitates the primary attack chains described above.


    ## Impact on Critical Infrastructure


    | Affected Sector | Deployment Scenario | Risk |

    |---|---|---|

    | Commercial Facilities | Office buildings, shopping centers | Unauthorized access, theft, surveillance |

    | Government Services | Federal buildings, courthouses | Espionage, security breach, classified exposure |

    | Healthcare | Hospital access control, pharmacy, restricted labs | Patient privacy violation, medical device tampering |

    | Critical Manufacturing | Restricted facility access | Sabotage, intellectual property theft |

    | Financial Services | Bank branches, data centers | Robbery, fraud, insider threat facilitation |

    | Energy & Utilities | Power plant access | Infrastructure sabotage, critical service disruption |


    Anviz does not publish comprehensive deployment figures, but the CX7 and CX2 series have achieved substantial market penetration across North America and Europe, making this vulnerability set a systemic risk across multiple economic sectors.


    ## Vendor Response—Or Lack Thereof


    CISA's disclosure indicates that Anviz "did not respond to CISA's attempts to coordinate these vulnerabilities." This departure from responsible disclosure norms leaves organizations in an untenable position:


  • No official patches exist for affected firmware versions
  • No documented workarounds have been provided
  • No timeline for remediation has been communicated
  • No security advisory from the vendor has been issued

    • This non-responsiveness suggests either that Anviz has deprioritized the matter or that the company lacks the development resources to address a vulnerability set this comprehensive. Either scenario presents serious risk to deploying organizations.


    ## Immediate Recommendations


    Organizations operating Anviz CX2 Lite, CX7, or CrossChex Standard devices should take the following actions:


    Immediate (This Week):

  • Conduct an inventory of all Anviz devices currently deployed
  • Contact Anviz directly through official support channels requesting patch status and timeline
  • Isolate affected devices from internet-facing exposure where possible
  • Review access logs on these devices for any signs of unauthorized connection attempts
  • Disable unnecessary features (SSH, RTTY, firmware upload) if the device interface permits

    • Near-Term (30 Days):

  • Evaluate alternative vendors for access control—this incident suggests potential broader security maturity issues at Anviz
  • Implement network segmentation to ensure these devices cannot directly reach internal critical systems
  • Deploy packet inspection or IDS rules to detect unauthenticated API calls to these devices
  • Escalate to CISA if your organization operates critical infrastructure; federal agencies may coordinate a collective response

    • Long-Term:

  • Plan hardware replacement to remove Anviz products from critical access control roles
  • Monitor for exploit activity in security logs and threat intelligence feeds
  • Consider vendor security questionnaires before future access control system procurements

    • ## HackWire Analysis


    This vulnerability set represents a rare convergence of multiple authentication architecture failures in a single product line—and the vendor's non-response to coordinated disclosure suggests an organization operating without mature security practices. For a company supplying physical access control to critical infrastructure, this represents a fundamental failure of security engineering.


    The progression from unauthenticated reconnaissance to firmware upload without integrity checks follows a cascade pattern familiar to security researchers: each vulnerability layer enables discovery and exploitation of the next. The presence of hardcoded cryptographic keys and cleartext credential transmission alongside missing authentication checks suggests code that was never designed with external attackers in mind—a dangerous assumption for an access control manufacturer.


    Organizations relying on these systems should treat this not as a routine patch cycle but as a signal to reassess their access control architecture entirely. Anviz's silence is itself a vulnerability—it indicates the vendor may lack the capability to execute secure product lifecycle management going forward.