« Back to list

CVE-2025-70515

Status: DeferredUnscored—

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log component.

CVSS

NVD hasn't assigned a CVSS score to this CVE (common since the April 2026 policy change).

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Fanvil — X7AAI

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2025-70515",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-07T15:16:51.670",
  "references": [
    {
      "url": "http://download.fanvil.com/Firmware/Release/X7A/",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.darkpoint.ca/blog/2026/02/27/Fanvil-x7a-PA2S-Vulnerability-Disclosure",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.fanvil.com/products/p1/x/20210921/5043.html",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log component."
    }
  ],
  "lastModified": "2026-10-07T15:57:37.147",
  "sourceIdentifier": "cve@mitre.org"
}