Fanvil x7a: Cross-Site Request Forgery in request handler
Summary
The request handler of Fanvil x7a firmware 2.6.0.1182 does not enforce cross-origin protection for state-changing requests. An attacker can therefore bypass the cross-origin boundary and trigger actions on any endpoint of the web management interface on behalf of a logged-in user. The attack requires that an authenticated administrator visits a malicious web page while logged into the device.
Affected
- Fanvil x7a firmware 2.6.0.1182 (per CVE record)
- Scope unclear: a third-party advisory also lists PA2S SIP Gateway 2.12.44.9 for this issue; the NVD references point to the X7A firmware directory
Fixed in
Unknown.
Workaround
- No vendor-published mitigation found.
- Restrict the web interface to a management VLAN or specific admin IP addresses.
- Disable unused web or WebSocket services if the firmware allows it.
Exploitation
- CISA SSVC: public proof of concept available, not automatable, total technical impact.
- CVSS 8.8 with user interaction required (UI:R).
- Not listed in CISA KEV as of the latest check.
- No confirmed in-the-wild exploitation found.
Our recommendation
- Check whether Fanvil x7a or PA2S devices are in use and whether their web interface is reachable from untrusted networks.
- Ask Fanvil for a firmware version that fixes this issue and update as soon as one is available.
- Restrict management access to admin networks and remind administrators not to browse untrusted sites while logged into device interfaces.
- Monitor for unexpected configuration changes on the devices.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fanvil x7a firmware directory download.fanvil.com
- DarkPoint: Fanvil x7a & PA2S Vulnerability Disclosure www.darkpoint.ca
- Fanvil product page www.fanvil.com
- OpenCVE: CVE-2025-70517 app.opencve.io
- Strix: CVE-2025-70517 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:23.
Original description (NVD)
The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the applications. Due to the lack of protection, cross-origin boundary can be completely bypassed, allowing for Cross-Site Request Forgery Attacks against any endpoint.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.