CVE-2026-32324

HighCVSS 7.7/10Last modified Oct 26, 2026

Description

Anviz CX7 Firmware is vulnerable because the application embeds reusable certificate/key material, enabling decryption of MQTT traffic and potential interaction with device messaging channels at scale.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-321

Affected software

Vendor	Product	Versions
Anviz	Anviz CX7 Firmware	All versions

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-03.jsonThird Party Advisory
https://www.anviz.com/contact-us.htmlProduct
https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-03US Government Resource

Timeline

Published: Apr 17, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-323258.5Privilege chaining issue exists in ServerView Agents for Windows V11.60.04 and earlier. If this vulnerability is exploited, a local authenti CVE-2026-323266.9SHARP routers do not perform authentication for some web APIs. The device information may be retrieved without authentication. If the admini CVE-2026-323279.1A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted s CVE-2026-323285.4Cross-Site Request Forgery (CSRF) vulnerability in shufflehound Lemmony lemmony allows Cross Site Request Forgery.This issue affects Lemmony CVE-2026-323295.3Missing Authorization vulnerability in Ays Pro Advanced Related Posts advanced-related-posts allows Exploiting Incorrectly Configured Access CVE-2026-323304.3Cross-Site Request Forgery (CSRF) vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Cross Site Request Forgery.This issue a CVE-2026-323315.4Missing Authorization vulnerability in Israpil Textmetrics webtexttool allows Exploiting Incorrectly Configured Access Control Security Leve CVE-2026-323325.3Missing Authorization vulnerability in Ays Pro Easy Form easy-form allows Exploiting Incorrectly Configured Access Control Security Levels.T CVE-2026-323337.1Unauthenticated Cross Site Scripting (XSS) in Mayosis Core <= 5.4.7 versions.CVE-2026-323345.3Missing Authorization vulnerability in raratheme JobScout jobscout allows Exploiting Incorrectly Configured Access Control Security Levels.T CVE-2026-323355.3Missing Authorization vulnerability in raratheme The Conference the-conference allows Exploiting Incorrectly Configured Access Control Secur CVE-2026-323365.3Missing Authorization vulnerability in raratheme Rara Business rara-business allows Exploiting Incorrectly Configured Access Control Securit