Fanvil X7A CVE-2025-70518

The exact prerequisite is network reachability to the Fanvil x7a web management portal, specifically its diagnostic ping tool, which passes user-supplied input to the underlying Android OS shell without sanitization. No authentication is required (CVSS PR:N) and no user interaction is needed (UI:N), so exploitation works against the default portal as shipped on firmware 2.6.0.1182. The primary limiting factor is exposure of the management interface: in correctly segmented deployments the portal is only reachable from a management VLAN or LAN, which constrains the attacker population to those with network access to that interface; devices with the portal exposed to untrusted networks are directly exploitable.

All available signals point to this being a genuine high-priority issue rather than an inflated-CVSS artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C) describes a network-reachable, low-complexity, unauthenticated flaw with scope change, and the description corroborates it: an unauthenticated attacker injects commands into the diagnostic ping tool and executes code in the underlying Android OS - a classic OS command injection (CWE-77) yielding full C:H/I:H/A:H. The SSVC framework reinforces urgency (Exploitation: poc, Automatable: yes, Technical Impact: total), meaning working proof-of-concept code exists and the attack can be scripted at scale. No EPSS score was supplied, and the CVE is NOT on CISA KEV, so there is no confirmation of active in-the-wild exploitation - the exploitation status is publicly available exploit code exists (per SSVC 'poc'), which is distinct from active exploitation. The CVSS and description are fully consistent (both indicate remote unauthenticated access), so there is no signal conflict. The main uncertainty is real-world reach: the CPE is a placeholder ('cpe:2.3:a:n/a:n/a:*') and affected-version metadata is 'n/a', so automated matching is broken even though the description precisely names Fanvil x7a firmware 2.6.0.1182.

An attacker who can reach the Fanvil x7a web management portal browses to the diagnostic ping tool and submits a hostname field containing shell metacharacters (e.g. appending a chained command). Because user input is passed unsanitized to the underlying Android OS shell, the injected command executes with the portal's privileges, giving the unauthenticated attacker code execution on the device. A public proof-of-concept is referenced (SSVC 'poc', and a DarkPoint disclosure write-up), so weaponization effort is minimal.