What is the CVSS score of CVE-2025-64056?

CVE-2025-64056 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of X210 Firmware are affected by CVE-2025-64056?

Organizations using Fanvil x210 should be aware of moderate risk from CVE-2025-64056, a missing authentication vulnerability rated CVSS 4.3.

Is there a public PoC exploit available for CVE-2025-64056?

Yes, a public proof-of-concept exploit is available for CVE-2025-64056. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-64056?

Within 30 days: Identify affected systems running Fanvil x210 and apply vendor patches as part of regular patch cycle. Audit authentication configurations.

X210 Firmware CVE-2025-64056

EUVD-2025-201413 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2025-12-05 cve@mitre.org

Authentication Bypass File Upload X210 Firmware Fanvil

4.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

4.3 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 17:08 euvd

EUVD-2025-201413

Analysis Generated

Mar 15, 2026 - 17:08 vuln.today

PoC Detected

Jan 09, 2026 - 02:18 vuln.today

Public exploit code

CVE Published

Dec 05, 2025 - 16:15 nvd

MEDIUM 4.3

DescriptionCVE.org

File upload vulnerability in Fanvil x210 V2 2.12.20 allows unauthenticated attackers on the local network to store arbitrary files on the filesystem.

Analysis

File upload vulnerability in Fanvil x210 V2 2.12.20 allows unauthenticated attackers on the local network to store arbitrary files on the filesystem.

Technical ContextAI

An authentication bypass vulnerability allows attackers to circumvent login mechanisms and gain unauthorized access without valid credentials. This vulnerability is classified as Missing Authentication for Critical Function (CWE-306).

RemediationAI

Implement robust authentication mechanisms. Use multi-factor authentication. Review authentication logic for bypass conditions. Remove default credentials.