Fanvil X7A CVE-2025-70517

Exploitation requires an administrator to be actively authenticated to the Fanvil x7a (firmware 2.6.0.1182) web management interface AND to be socially engineered into visiting an attacker-controlled web page during that session (UI:R). The core enabling condition is the request handler's complete absence of cross-origin/CSRF protection on state-changing endpoints - no anti-CSRF token, no origin/referer validation - so the forged request must simply reach a reachable management endpoint. Limiting factors: the attacker gains no credentials and cannot act without a victim admin's live session and interaction; impact is bounded by what the admin's privileges allow, and same-origin policy limits reading back any confidential response.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) reflects a classic CWE-352 CSRF flaw: network-reachable, low complexity, no attacker authentication, but requiring victim interaction (UI:R) - a logged-in administrator must visit an attacker-controlled page. The high C/I/A impacts are vendor/reporter-assigned and assume CSRF against 'any endpoint' yields full control over device state; note that genuine confidentiality loss via CSRF is normally constrained by the browser same-origin policy (the attacker forces requests but typically cannot read responses), so C:H is optimistic for a pure CSRF issue. EPSS is low at 0.16% (5th percentile), the CVE is NOT on CISA KEV, and there is no explicit POC flag in the input - so this is no public exploit identified at time of analysis. The signals are consistent rather than conflicting: a high CVSS driven by broad impact assumptions, but low real-world exploitation probability. This is a meaningful but not emergency priority - exploitation depends on social-engineering an authenticated admin, and the affected product is a niche VoIP endpoint rather than widely-exposed infrastructure. A third-party disclosure blog (darkpoint.ca) is referenced and may contain technical detail or proof-of-concept, which could raise exploitability if weaponized; defenders should review it directly.

An attacker crafts a malicious web page containing hidden form submissions or auto-firing requests targeting the Fanvil x7a phone's administrative endpoints. When an authenticated administrator (with an active session) is lured into visiting the page, the browser silently issues state-changing requests - e.g., altering SIP/network configuration, redirecting calls, or rebooting the device - without any CSRF token validation. No public exploit is identified in the input, though a referenced disclosure blog may document the technique.