Fanvil X7A firmware: Missing authentication in websocket handler

Summary

The websocket handler of Fanvil X7A firmware 2.6.0.1182 does not enforce authentication for sessionless users. A remote attacker without credentials can view device resources such as operational logs and send diagnostic requests. No user interaction is required and the attack needs only network access to the device's web interface.

Affected

• Fanvil X7A firmware 2.6.0.1182
• Other firmware versions: not specified in the supplied data

Fixed in

Unknown. No fixed firmware version has been published in the supplied sources.

Workaround

• Do not expose the device's web or websocket interface to the internet or untrusted networks.
• Restrict access to a management VLAN using firewall rules.
• No vendor workaround has been published.

Exploitation

• Not known to be exploited in the wild. The CVE is not in the CISA KEV catalog.
• CISA SSVC: automatable yes, technical impact total.
• The Darkpoint write-up contains a proof-of-concept websocket request for unauthenticated log access.

Our recommendation

• Inventory all Fanvil X7A devices and confirm the firmware version.
• Check whether the web or websocket interface is reachable from untrusted networks and remove that exposure.
• Ask Fanvil or your reseller for a fixed firmware version and an advisory.
• Monitor device access and re-check NVD and CISA KEV regularly.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE record on OpenCVE app.opencve.io
• DarkPoint: Fanvil x7a & PA2S Vulnerability Disclosure www.darkpoint.ca
• Fanvil product page www.fanvil.com
• Fanvil X7A firmware release index download.fanvil.com
• CISA ADP Vulnrichment summary hol.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:20.