What is the CVSS score of CVE-2025-64053?

CVE-2025-64053 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of X210 Firmware are affected by CVE-2025-64053?

Fanvil x210 IP phones (version 2.12.20) are vulnerable to a buffer overflow attack that could allow unauthorized users to disrupt phone system operations or gain control of devices through malicious…

Is there a public PoC exploit available for CVE-2025-64053?

Yes, a public proof-of-concept exploit is available for CVE-2025-64053. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2025-64053?

Within 24 hours: Identify and inventory all Fanvil x210 devices running version 2.12.20 in your environment and restrict network access to the /cgi-bin/webconfig endpoint. Within 7 days: Implement WAF rules to block POST requests to the vulnerable endpoint and segment IP phone networks from general user traffic where feasible. Within 30 days: Contact Fanvil for patch availability status, evaluate firmware upgrade options, and consider replacing affected devices if no patch becomes available.

X210 Firmware CVE-2025-64053

EUVD-2025-201423 HIGH

Classic Buffer Overflow (CWE-120)

2025-12-05 cve@mitre.org

Buffer Overflow Denial Of Service X210 Firmware Fanvil

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 17:08 euvd

EUVD-2025-201423

Analysis Generated

Mar 15, 2026 - 17:08 vuln.today

PoC Detected

Jan 09, 2026 - 02:17 vuln.today

Public exploit code

CVE Published

Dec 05, 2025 - 16:15 nvd

HIGH 7.5

DescriptionCVE.org

A Buffer overflow vulnerability on Fanvil x210 2.12.20 devices allows attackers to cause a denial of service or potentially execute arbitrary commands via crafted POST request to the /cgi-bin/webconfig?page=upload&action=submit endpoint.

Analysis

Technical ContextAI

A buffer overflow occurs when data written to a buffer exceeds its allocated size, potentially overwriting adjacent memory and corrupting program state. This vulnerability is classified as Classic Buffer Overflow (CWE-120).