Fanvil x7a: Cross-Site Request Forgery in web management interface
Summary
The request handler of Fanvil x7a firmware 2.6.0.1182 does not enforce cross-origin protection for state-changing requests. An attacker can bypass the cross-origin boundary and perform Cross-Site Request Forgery attacks against any endpoint of the device's web interface. Exploitation requires a logged-in administrator to visit an attacker-controlled web page.
Affected
- Fanvil x7a firmware 2.6.0.1182 (per CVE description)
- Other firmware builds: Unknown.
- The CVE references also mention PA2S firmware 2.12.44.9, but this has not been confirmed by Fanvil.
Fixed in
Unknown. No Fanvil security advisory or confirmed fixed version found. Newer firmware builds exist (for example X7A-2.6.12.220, 2026-02-28), but no link to a fix for this CVE has been confirmed.
Workaround
- No vendor-confirmed workaround available.
- Keep the device web interface off the internet and restrict it to a management VLAN or VPN.
- Require administrators to log out after use and use a dedicated browser profile for device administration.
Exploitation
- A public proof of concept is listed in the CVE record (CISA SSVC: exploitation poc). It has not been verified.
- No evidence of exploitation in the wild found. The CVE is not listed in CISA KEV.
- Automatable: no. User interaction is required (CVSS UI:R).
Our recommendation
- Check whether the x7a web interface is reachable from the internet and restrict access if it is.
- Check the release notes on Fanvil's download page and update to a firmware version that Fanvil confirms fixes this issue.
- Monitor the device for unexpected configuration changes.
- Remind administrators not to browse other sites while logged into device management interfaces.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fanvil x7a & PA2S Vulnerability Disclosure (DarkPoint) www.darkpoint.ca
- Fanvil PA2S firmware directory download.fanvil.com
- OpenCVE: CVE-2025-70522 app.opencve.io
- Fanvil x7a download page fanvil.com
- Strix: CVE-2025-70522 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:23.
Original description (NVD)
The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the applications. Due to the lack of protection, cross-origin boundary can be completely bypassed, allowing for Cross-Site Request Forgery Attacks against any endpoint.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.