Exploit discussion active in current signal (5 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This causes crafted archives to be accepted, enabling attackers to plant and execute code and obtain a reverse shell.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 4 products
| Date | Total | Labels |
|---|
| 2026-04-17 | 1 | PoC1 |
| 2026-04-18 | 2 | Disclosure1General1 |
| 2026-05-12 | 5 | Disclosure3General2 |
--- Validated by the Lyrie Threat Intelligence Pipeline — 3 independent sources confirmed before publication. No speculation. CVE: CVE-2026-35546 CVSS: 9.8 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity: CRITICAL Status: Critical advisory
Post summary
An advisory confirms a new CVE (CVE-2026-35546) with a critical severity, CVSS 9.8, but provides no PoC, exploit code, or patch details.
CVE: CVE-2026-35546 CVSS: 9.8 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity: CRITICAL Status: Critical advisory Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads.
Post summary
Anviz CX2 Lite and CX7 devices are critically vulnerable to unauthenticated firmware uploads, but no PoC, exploit, or active exploitation details are provided.
References CVE: CVE-2026-35546 CVSS: 9.8 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity: CRITICAL Status: Critical advisory
Post summary
The statement lists CVE-2026-35546’s critical severity but provides only basic CVSS information without details on exploitation, patching, or PoC.
CRITICAL: CVE-2026-35546 (CVSS 9.8) — anviz cx7 firmware. CVE: CVE-2026-35546 CVSS: 9.8 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity: CRITICAL Status: Critical advisory
Post summary
The text announces CVE‑2026‑35546 as a critical vulnerability in Anviz CX7 firmware, with full CVSS details but no indication of PoC, active exploitation or mitigation.
CVE-2026-35546 Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This causes crafted archives to be accepted, enabling attackers to plant and execute code … https://www.cve.org/CVERecord?id=CVE-2026-35546
Post summary
Anviz CX2 Lite and CX7 devices are vulnerable to unauthenticated firmware uploads via crafted archives, potentially enabling code execution.
🚨 CVE-2026-35546: Anviz Products Missing Authentic... Anviz access control devices accept any firmware blob without auth checks - instant RCE with a zip file and zero effort... https://zerodaysignal.com/vulnerability/CVE-2026-35546 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
Anviz access control devices allow unauthenticated RCE via a crafted firmware zip file; a proof‑of‑concept is referenced by a URL.
https://lyrie.ai/research/research/cve-2026-35546-anviz-cx7-firmware #lyrie #cybersecurity #CVE #threatintel #zerodayattack
Post summary
The input references a CVE via a URL and hashtags but provides no substantive information on exploitation, patching, technical details, or debunking.
🚨*CVE* CVE-2026-35546 Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This causes crafted archives to be accepted, enabling attackers to plant and execute code … https://www.cve.org/CVERecord?id=CVE-2026-35546 ----- Traducción: CVE-2026-35546 Anv… http://infoflow.cloud`
Post summary
The post discloses CVE‑2026‑35546 as an unauthenticated firmware upload flaw enabling remote code execution, but it offers no PoC, exploit code, or patch details.
4 of 4 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | anviz | cx2_lite | - | - | - |
| OS | anviz | cx2_lite_firmware | - | - | - |
| HW | anviz | cx7 | - | - | - |
| OS | anviz | cx7_firmware | - | - | - |