Authenticated CSV Upload Vulnerability in Anviz CX7 Firmware

CVE-2026-31927

What is CVE-2026-31927?

The Anviz CX7 Firmware has a security flaw that arises from an authenticated CSV upload process. This vulnerability allows an attacker to exploit a path traversal condition, enabling the unauthorized overwriting of critical files, including system files like /etc/shadow. When exploited in conjunction with specific changes to debug settings, this flaw can facilitate unauthorized SSH access, potentially compromising the integrity and security of the affected device.

References