Paper/Archive/CVE-2025-70518

CVE-2025-70518

mitre — The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely.

EPSS 0.6%public exploit CVSS 10.0

critical.is priorityof 100

CVSS 10.0 (ADP)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 EPSS percentile 46.5.465 × 209.3 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

CISA ADP10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

reffanvil.com/products/p1/x/20210921/5043.html refdownload.fanvil.com/Firmware/Release/X7A exploitdarkpoint.ca/blog/2026/02/27/Fanvil-x7a-PA2S-Vulnerability-Disclosure