Paper/Archive/CVE-2025-70521

CVE-2025-70521

mitre — The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely.

EPSS 0.4%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 36.8.368 × 207.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reffanvil.com/products/p5/wulianwangwangguan_1/20210921/5035.html refdownload.fanvil.com/Firmware/Release/PA2S refdarkpoint.ca/blog/2026/02/27/Fanvil-x7a-PA2S-Vulnerability-Disclosure