CVE-2025-70520

Published: Oct 7, 2026Modified: Oct 15, 2026Deferred

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests.

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (4)

http://download.fanvil.com/Firmware/Release/PA2S/

Source: cve@mitre.org

https://www.darkpoint.ca/blog/2026/02/27/Fanvil-x7a-PA2S-Vulnerability-Disclosure

Source: cve@mitre.org

https://www.fanvil.com/products/p5/wulianwangwangguan_1/20210921/5035.html

Source: cve@mitre.org

https://www.darkpoint.ca/blog/2026/02/27/Fanvil-x7a-PA2S-Vulnerability-Disclosure

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.