Anviz Biometric Devices Contain Critical Vulnerabilities Allowing Unauthorized Access

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a security advisory regarding multiple critical vulnerabilities discovered in Anviz biometric devices, which are widely used for physical access control and time attendance systems across various industries.

The vulnerabilities affect a range of Anviz products including fingerprint readers, facial recognition terminals, and integrated access control systems. According to the advisory, these flaws could allow malicious actors to bypass authentication mechanisms and gain unauthorized access to secured areas or sensitive systems.

Technical Details of the Vulnerabilities

The specific vulnerabilities identified include:

• Authentication bypass flaws that could allow attackers to circumvent fingerprint or facial recognition verification
• Hardcoded credentials embedded in device firmware that provide backdoor access
• Weak encryption implementations that expose sensitive data transmissions
• Remote code execution vulnerabilities that could allow complete device compromise

These issues stem from poor security practices in the device firmware and software architecture. The hardcoded credentials are particularly concerning as they cannot be changed by end users and provide persistent access points for attackers who discover them.

Affected Products and Risk Assessment

The security advisory covers multiple Anviz product lines, including but not limited to:

• W2 Pro series facial recognition terminals
• T5 Pro fingerprint and card readers
• C2 Pro integrated access control systems
• Cloud-based management platforms used to administer these devices

Organizations using these devices in critical infrastructure, government facilities, healthcare settings, or corporate environments face elevated risk. An attacker exploiting these vulnerabilities could potentially gain physical access to restricted areas, manipulate attendance records, or use compromised devices as entry points into broader network systems.

Mitigation and Recommendations

CISA recommends several immediate actions for organizations using Anviz devices:

1. Isolate affected devices on separate network segments to limit potential attack propagation
2. Apply firmware updates as soon as they become available from Anviz
3. Implement network monitoring to detect suspicious access attempts
4. Consider alternative vendors for new deployments until vulnerabilities are fully addressed
5. Conduct security assessments of existing physical access control infrastructure

Anviz has acknowledged the vulnerabilities and is reportedly working on security patches. However, the patching process for embedded devices can be complex, particularly in large deployments where physical access to each device may be required.

Broader Implications for IoT Security

This incident highlights ongoing concerns about security in Internet of Things (IoT) devices, particularly those used for physical security. Biometric devices represent an attractive target for attackers because they often serve as the first line of defense for physical and digital assets.

The Anviz vulnerabilities demonstrate several systemic issues in IoT security:

• Inadequate security testing before product release
• Difficulty in patching deployed devices at scale
• Long-term support challenges as manufacturers move to newer product lines
• Supply chain risks when devices are manufactured in regions with different security standards

Organizations are increasingly recognizing that physical security devices must be treated with the same security rigor as traditional IT infrastructure. This includes regular vulnerability assessments, network segmentation, and incident response planning specific to physical security systems.

Industry Response and Future Outlook

The security community has responded with concern to these findings, noting that biometric devices should adhere to higher security standards given their role in authentication and access control. Some security experts recommend that organizations using such devices implement defense-in-depth strategies that don't rely solely on biometric authentication.

For organizations unable to immediately replace vulnerable devices, security professionals recommend implementing additional authentication factors, such as PIN codes or RFID cards in conjunction with biometric verification, to create layered security approaches.

As the threat landscape continues to evolve, incidents like the Anviz vulnerabilities serve as important reminders that all connected devices, regardless of their primary function, must be considered potential attack vectors and secured accordingly.

The full CISA advisory provides technical details and specific CVE identifiers for organizations seeking to assess their exposure and implement appropriate mitigations.