Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug
settings (e.g., enabling SSH), allowing unauthorized state changes tha…

Anviz CX2 Lite and CX7 devices are vulnerable to unauthenticated POST requests that can modify debug settings, including enabling SSH access. This vulnerability allows unauthorized attackers to change system states without authentication, creating a pathway for further compromise. The vulnerability affects access control systems and could lead to complete device takeover. The ability to enable SSH through unauthenticated requests represents a critical security flaw in these access control devices.