CVE-2026-32324

Summary

Anviz CX7 Firmware is  vulnerable because the application embeds reusable certificate/key material, enabling decryption of MQTT traffic and potential interaction with device messaging channels at scale.

Affected Software

VendorProductVersion RangeStatus
AnvizAnviz CX7 FirmwareAll versionsaffected

Weaknesses

  • CWE-321: CWE-321 Use of Hard-coded Cryptographic Key

Workarounds

Anviz did not respond to CISA's attempts to coordinate these vulnerabilities. Users should contact Anviz for more information at https://www.anviz.com/contact-us.html.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References