CVE-2026-40434— Anviz CrossChex Standard Improper Verification of Source of a Communication Channel
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-40434
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Anviz CrossChex Standard Improper Verification of Source of a Communication Channel
Source: NVD (National Vulnerability Database)
Vulnerability Description
Anviz CrossChex Standard lacks source verification in the client/server channel, enabling TCP packet injection by an attacker on the same network to alter or disrupt application traffic.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
通信信道源的不正确验证
Source: NVD (National Vulnerability Database)
Vulnerability Title
Anviz CrossChex Standard 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Anviz CrossChex Standard是美国Anviz公司的一款用于门禁与考勤数据管理的集中控制软件。 Anviz CrossChex Standard存在安全漏洞，该漏洞源于客户端/服务器通道缺少源验证，可能导致同一网络上的攻击者注入TCP数据包以更改或中断应用程序流量。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Anviz | Anviz CrossChex Standard | All versions | - |
II. Public POCs for CVE-2026-40434
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-40434
Please Login to view more intelligence information
Same Patch Batch · Anviz · 2026-04-17 · 12 CVEs total
| CVE-2026-35546 | 9.8 CRITICAL | Anviz Products Missing Authentication for Critical Function |
| CVE-2026-35682 | 8.8 HIGH | Anviz CX2 Lite Command Injection |
| CVE-2026-40066 | 8.8 HIGH | Anviz Products Download of Code Without Integrity Check |
| CVE-2026-32324 | 7.7 HIGH | Anviz CX7 Firmware Use of Hard-coded Cryptographic Key |
| CVE-2026-32650 | 7.5 HIGH | Anviz CrossChex Standard Algorithm Downgrade |
| CVE-2026-40461 | 7.5 HIGH | Anviz Products Missing Authentication for Critical Function |
| CVE-2026-33569 | 6.5 MEDIUM | Anviz Products Cleartext Transmission of Sensitive Information |
| CVE-2026-35061 | 5.3 MEDIUM | Anviz Products Missing Authorization |
| CVE-2026-32648 | 5.3 MEDIUM | Anviz Products Missing Authorization |
| CVE-2026-33093 | 5.3 MEDIUM | Anviz Products Missing Authorization |
| CVE-2026-31927 | 4.9 MEDIUM | Anviz CX7 Firmware Relative Path Traversal |
IV. Related Vulnerabilities
Same vendor: Anviz
- CVE-2026-32650
Anviz CrossChex Standard Algorithm Downgrade - CVE-2026-35682
Anviz CX2 Lite Command Injection - CVE-2026-40066
Anviz Products Download of Code Without Integrity Check - CVE-2026-35546
Anviz Products Missing Authentication for Critical Function - CVE-2026-40461
Anviz Products Missing Authentication for Critical Function
Same weakness: CWE-940
- CVE-2026-35643
OpenClaw < 2026.3.22 - Arbitrary Code Execution via Unvalida - CVE-2026-33875
Authenticator Vulnerable to Authentication Flow Hijack - CVE-2019-25613
Easy Chat Server 3.1 Denial of Service via message Parameter - CVE-2026-2967
Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer v - CVE-2026-22269
Dell PowerProtect Data Manager 安全漏洞
V. Comments for CVE-2026-40434
No comments yet