Fanvil x7a: Command injection in management portal ping tool
Summary
The diagnostic ping tool in the management portal of Fanvil x7a firmware 2.6.0.1182 does not handle user input securely. An unauthenticated remote attacker can send a crafted WebSocket request to run arbitrary shell commands in the underlying Android operating system. The Darkpoint disclosure contains a proof-of-concept request for this issue, and CISA SSVC rates automatable as yes but exploitation as none.
Affected
- Fanvil x7a firmware 2.6.0.1182 (per CVE record)
- Fanvil PA2S SIP Gateway firmware 2.12.44.9 (listed in the Darkpoint disclosure, not in the CVE record; unverified)
Fixed in
Unknown. No fixed firmware version has been confirmed by the vendor.
Workaround
Unknown. No vendor-confirmed workaround.
Exploitation
- Proof-of-concept request published in the Darkpoint disclosure (27 February 2026)
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact total
- Not listed as known exploited (KEV: No)
Our recommendation
- Inventory all Fanvil x7a and PA2S devices and record their firmware versions.
- Remove any internet exposure of the web management interface immediately and restrict it to admin VLANs or VPN. This is a recommendation, not a vendor measure.
- Ask Fanvil support for the fixed firmware version and release notes; do not deploy an unverified build.
- Monitor the devices for unusual outbound connections or unexpected processes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2025-70521 on OpenCVE app.opencve.io
- Fanvil x7a & PA2S Vulnerability Disclosure (DarkPoint) www.darkpoint.ca
- Fanvil firmware release directory PA2S download.fanvil.com
- Fanvil product page www.fanvil.com
- CVE-2025-70521 CISA ADP Vulnrichment (mirror) hol.org
- CVE-2025-70521 on Strix www.strix.ai
- PT-2026-107528 on Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:50.
Original description (NVD)
The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.