Fanvil x7a / PA2S: Missing authentication in websocket handler
Summary
The websocket handler of Fanvil x7a firmware 2.6.0.1182 does not enforce authentication for sessionless users. A remote, unauthenticated attacker can view device resources such as operational logs and send diagnostic requests. The CVE record rates the issue 9.8 (Critical), but other sources report different scores, so verify this on NVD.
Affected
- Fanvil x7a firmware 2.6.0.1182 (confirmed by the CVE record and vendor-linked research)
- Fanvil PA2S SIP Gateway firmware 2.12.44.9 (reported by a third-party advisory, not verified against the vendor or NVD)
Fixed in
Unknown.
Workaround
- Do not expose the device to the internet.
- Restrict access to the web and websocket ports to management VLANs or trusted hosts.
- Check logs for unexpected connections.
Exploitation
- CISA SSVC: exploitation status 'poc' (proof of concept), automatable: yes, technical impact: total.
- Not listed in CISA KEV; no confirmed exploitation in the wild.
- A related command injection issue (CVE-2025-70521) in the same product family is reported to allow unauthenticated code execution.
Our recommendation
- Inventory all Fanvil x7a and PA2S devices and their firmware versions.
- Remove direct internet access to these devices now.
- Restrict management access to trusted networks.
- Ask Fanvil or your distributor for a fixed firmware and its release notes, then update.
- Monitor logs for unknown websocket connections.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- DarkPoint: Fanvil x7a & PA2S Vulnerability Disclosure www.darkpoint.ca
- Fanvil PA2S firmware download directory download.fanvil.com
- Fanvil product page www.fanvil.com
- OpenCVE: CVE-2025-70520 app.opencve.io
- Strix: CVE-2025-70520 www.strix.ai
- Third-party advisory (imfht) cve.imfht.com
- Positive Technologies via Vulners: PT-2026-107527 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:51.
Original description (NVD)
The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.