Fanvil
Fanvil X7A: vulnerabilities and CVEs
Fanvil X7A has 8 published vulnerabilities, 8 of them in the last 12 months. 4 are rated critical and 0 are listed by CISA as actively exploited.
CVEs8
Last 12 months8
Critical4
Actively exploited0
All vulnerabilities in the catalogue →⭐ Follow this technology
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-70522 | High (8.8) | 0.16% | — | Oct 7, 2026 | The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the applications. Due to the lack of protection,… |
| CVE-2025-70521 | Critical (9.8) | 0.43% | — | Oct 7, 2026 | The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject… |
| CVE-2025-70520 | Critical (9.8) | 0.40% | — | Oct 7, 2026 | The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device… |
| CVE-2025-70519 | Medium (6.1) | 0.23% | — | Oct 7, 2026 | The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to… |
| CVE-2025-70518 | Critical (10) | 0.56% | — | Oct 7, 2026 | The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject… |
| CVE-2025-70517 | High (8.8) | 0.16% | — | Oct 7, 2026 | The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the applications. Due to the lack of protection,… |
| CVE-2025-70516 | Critical (9.1) | 0.33% | — | Oct 7, 2026 | The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device… |
| CVE-2025-70515 | Unscored | 0.18% | — | Oct 7, 2026 | The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to… |
🎯 How it gets exploited (ATT&CK techniques)
Number of CVEs of this technology mapped to each exploitation or primary-impact technique.