Anviz CrossChex Standard: Improper Verification of Source of a Communication Channel
CVE-2026-40434 is a high-severity improper verification of source of a communication channel vulnerability in Anviz CrossChex Standard from Anviz, with a CVSS 3.1 base score of 8.1 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. Affected Anviz CrossChex Standard versions: All versions. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.24% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Check which version of Anviz CrossChex Standard you run against the affected versions below, and install the vendor's latest release.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Anviz | Anviz CrossChex Standard | All versions | Not stated |
| Anviz | Crosschex Standard | Not specified in the record | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- AdjacentThe attacker must be on the same local network segment.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- NoneNo data is disclosed.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. Scored by CNA (hq.dhs.gov).
Official description
Anviz CrossChex Standard lacks source verification in the client/server channel, enabling TCP packet injection by an attacker on the same network to alter or disrupt application traffic.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Improper Verification of Source of a Communication Channel
The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.
How developers prevent this class of flaw
- Use a mechanism that can validate the identity of the source, such as a certificate, and validate the integrity of data to ensure that it cannot be modified in transit using an Adversary-in-the-Middle (AITM) attack. When designing functionality of actions in the URL scheme, consider whether the action should be accessible to all mobile applications, or if an allowlist of applications to interface with is appropriate.
More Improper Verification of Source of a Communication Channel vulnerabilities (CWE-940)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Third-party and government advisories
- github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-03.jsonThird Party Advisory
- cisa.gov/news-events/ics-advisories/icsa-26-106-03US Government Resource
Other references
- anviz.com/contact-us.htmlProduct
Other vulnerabilities in Anviz CrossChex Standard
- 7.5 High severity
Recent Improper Verification of Source of a Communication Channel vulnerabilities
- 8.8 High severity
- 9.3 Critical severity
- 7.5 High severity
- 7.5 High severity
- 9.3 Critical severity
- 7.6 High severity
Spotted an error? Tell us.