EUVD-2025-211048
GHSA-fpvc-vjr4-6cw4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft HTML/JS payload in loggable input
-
ExploitDeliver crafted request/link to device
-
ExecutionAdmin renders device log component
-
ImpactJavaScript executes in operator browser session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that attacker-supplied data be reflected into the Fanvil x7a device log component and that a user - typically an administrator with access to the device's web management interface - then open and render that log page (UI:R), at which point the unsanitized HTML/JavaScript executes in their browser. Limiting factors: the payload only fires when the device log view is rendered (no automatic/standalone execution), the attacker must be able to reach the management interface and get their input recorded, and impact is confined to the viewing operator's browser session rather than the device OS. CVSS PR:N indicates no attacker-side authentication is required to deliver the payload. |
| Impact | This is a medium-severity reflected XSS (CWE-79) in the Fanvil x7a firmware (2.6.0.1182) device log component, carrying a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The network vector and low attack complexity favor the attacker, but UI:R is the dominant limiting factor: a victim must actually render the vulnerable device log page for the injected HTML/JavaScript to fire, which caps this well below a wormable/unauthenticated-RCE priority. The scope change (S:C) and low confidentiality/integrity impact are consistent with classic reflected XSS executing in the browser context of whoever views the log. No EPSS score was provided in the input, so exploitation probability cannot be quantified here; the vulnerability is NOT on CISA KEV and NO public exploit code is referenced, so this is 'no public exploit identified at time of analysis.' Signals are internally consistent (CVSS metrics match a reflected XSS in a web management component), with no CVSS-vs-description conflict. Net: a legitimate issue to patch on affected IP-phone/gateway fleets, but not an emergency - realistic risk is bounded by the need for a privileged operator to view a maliciously seeded log entry. |
| Exploit ScenarioDerived | An attacker submits crafted input (e.g., via a request or field that the device records) containing HTML/JavaScript that is written unsanitized into the device log. When an administrator subsequently opens the device log component in the web management interface, the payload is reflected and executes in the admin's browser session. No public proof-of-concept is referenced; network reachability to the management interface and the operator rendering the log are prerequisites. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Reflected cross-site scripting in the Fanvil x7a IP phone firmware (2.6.0.1182) allows a remote, unauthenticated attacker to inject HTML and JavaScript into the device log component, which then executes in the browser of any user who opens the affected log view - in practice an administrator using the phone's web management interface. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting that exploitation requires user interaction (the victim must render the log page) while the injected script runs in a scope beyond the vulnerable component, though confidentiality and integrity impact is limited to the viewer's browser session rather than the underlying device OS. No public exploit code has been identified at time of analysis and the issue is not listed on CISA KEV, so risk is currently tied to exposure of the management interface rather than observed exploitation.
RemediationAI
No vendor-released patch identified at time of analysis - the references supplied point only to Fanvil product/firmware pages (https://www.fanvil.com/products/p5/wulianwangwangguan_1/20210921/5035.html and http://download.fanvil.com/Firmware/Release/PA2S/) plus a third-party disclosure (https://www.darkpoint.ca/blog/2026/02/27/Fanvil-x7a-PA2S-Vulnerability-Disclosure) and the NVD entry, so the first action is to check Fanvil's release directory for a firmware revision newer than 2.6.0.1182 and apply it once published. Until then, the most effective compensating control is to remove reachability of the phone's web management interface from untrusted networks: place x7a/PA2S devices on a dedicated management VLAN, block HTTP/HTTPS management ports at the perimeter so only trusted administrator hosts can connect, and disable remote web administration where the deployment does not require it - the trade-off being that remote support and centralized provisioning may need to be rerouted through a VPN or jump host. Administrators should also avoid opening the device log page after periods in which untrusted input (for example, crafted SIP headers, HTTP requests, or caller-supplied fields that reach the log) may have been recorded, since the payload only fires when the log view is rendered; a browser-side mitigation such as a strict Content-Security-Policy proxy or a hardened browser profile can reduce script execution but degrades usability and is not a substitute for patched firmware. Where log review is operationally required, retrieve logs out-of-band or parse them as text rather than rendering the vendor web page, and monitor the vendor channel for an official fix before treating any device as remediated.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic reflected cross-site scripting vulnerability (CWE-79) in which user-supplied data written into the Fanvil x7a device log is neither sanitized nor output-encoded before being rendered as HTML by the firmware's web-based management interface. Because the log view is a server-side web page delivered by the phone's embedded HTTP service, an attacker who can get crafted input recorded into a log entry can have that payload echoed back unescaped inside the page; the browser then parses it as markup and executes any embedded script. The CVSS scope-change (S:C) element captures the fact that the script escapes the vulnerable component's security context and acts on the victim's browser origin, while the C:L/I:L/A:N sub-score correctly limits impact to the viewing operator's session (credential/session theft potential, page tampering) rather than the phone platform itself. The supplied CPE strings are placeholder values (cpe:2.3:a:n/a:n/a) and EUVD lists the affected version as generic "n/a n/a", so product identification rests on the vendor references and the Dark Point advisory, which tie the issue to x7a firmware 2.6.0.1182 and the related PA2S firmware distribution channel.
Know when Fanvil gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Reflected XSS reachable over the network (AV:N/AC:L) with no attacker auth (PR:N) but requiring a victim to render the log (UI:R); payload executes across the browser trust boundary (S:C) with limited C/I and no availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log component.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to access admi
A reflected Cross Site Scripting (XSS) vulnerability on Fanvil x210 2.12.20 devices allows attackers to cause a denial o
Directory traversal vulnerability in Fanvil x210 V2 2.12.20 allows unauthenticated attackers on the local network to sto
A Buffer overflow vulnerability on Fanvil x210 2.12.20 devices allows attackers to cause a denial of service or potentia
Unauthenticated command injection in the Fanvil X7A IP phone's web management portal (firmware 2.6.0.1182) lets any atta
Unauthenticated users who can reach the websocket handler on a Fanvil X7A device running firmware 2.6.0.1182 can read op
Unauthenticated command injection in the Fanvil x7a IP phone's web management portal (firmware 2.6.0.1182) allows any at
Unauthenticated network access to the WebSocket handler on Fanvil X7A desk phones running firmware 2.6.0.1182 exposes de
An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to execute arb
Cross-site request forgery in the Fanvil X7A IP phone web management interface (firmware 2.6.0.1182) allows any state-ch
Cross-site request forgery in the Fanvil x7a IP desk phone (firmware 2.6.0.1182) lets an attacker who lures an authentic
File upload vulnerability in Fanvil x210 V2 2.12.20 allows unauthenticated attackers on the local network to store arbit
Exploit-DB