Anviz CX2 Lite and CX7 devices are vulnerable to unauthenticated firmware uploads that allow attackers to upload crafted archives. This vulnerability enables attackers to plant and execute malicious code on the affected devices. Successful exploitation can lead to complete system compromise and the ability to obtain a reverse shell. The vulnerability affects access control devices commonly used in enterprise environments. No authentication is required to exploit this vulnerability, making it particularly dangerous.