Fanvil x7a: Unauthenticated command injection in diagnostic ping tool
Summary
The management portal's diagnostic ping tool of the Fanvil x7a firmware 2.6.0.1182 does not properly validate user input. An unauthenticated remote attacker can inject operating system commands and execute code in the underlying Android operating system of the device. The vendor-listed CVSS score is 10.0 (Critical), and CISA SSVC rates exploitation as PoC and automatable.
Affected
- Fanvil x7a firmware 2.6.0.1182
- Related Fanvil PA2S SIP gateway firmware 2.12.44.9 is named in a separate CVE record (CVE-2025-70521), not in this entry
Fixed in
Unknown. No vendor advisory or firmware changelog naming a fixed x7a build was found.
Workaround
- No vendor-published workaround found.
- Restrict access to the management web interface to a trusted management VLAN.
- Block the device's web and management ports from untrusted networks at the firewall.
Exploitation
- A public proof of concept is reported in a third-party write-up (not verified). CISA SSVC: exploitation PoC, automatable yes.
- No evidence of exploitation in the wild found.
Our recommendation
- Check whether any x7a device is reachable from the internet or untrusted networks and remove that exposure immediately.
- Inventory all x7a devices running 2.6.0.1182.
- Obtain a vendor-confirmed fixed firmware from Fanvil and apply it; if none is available, plan replacement.
- Monitor the device and its network segment for unexpected connections or commands.
- Treat the related CVEs for this firmware (CVE-2025-70515 to 70522) as one remediation project.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- OpenCVE CVE record CVE-2025-70518 app.opencve.io
- Strix CVE page CVE-2025-70518 www.strix.ai
- Positive Technologies via Vulners PT-2026-107525 vulners.com
- DarkPoint Fanvil x7a & PA2S vulnerability disclosure www.darkpoint.ca
- Fanvil product page www.fanvil.com
- Fanvil firmware directory X7A download.fanvil.com
- Multi-CVE advisory summary cve.imfht.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:33.
Original description (NVD)
The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.