Fanvil x7a CVE-2025-70521

Exploitation requires network reachability to the Fanvil x7a web management portal and the ability to invoke its diagnostic ping tool, which per the description and CVSS PR:N needs no authentication. The limiting factor is exposure of that management interface: it is typically reachable only from the LAN or a management VLAN, so risk drops sharply where the portal is not exposed to untrusted networks. No user interaction is required (UI:N), and the condition is specific to firmware version 2.6.0.1182.

Signals are largely aligned toward high severity but temper the urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remote, unauthenticated, low-complexity command injection with total impact (C:H/I:H/A:H), scoring 9.8, and this matches the description of an unauthenticated attacker injecting OS commands through the diagnostic ping tool. SSVC reinforces this: Technical Impact is 'total' and the flaw is 'Automatable: yes', consistent with a trivially scriptable injection. However, SSVC Exploitation is 'none', there is no CISA KEV listing, no EPSS score was supplied, and no public exploit was provided in the input - so despite the maximal CVSS this is not a confirmed in-the-wild threat and should be prioritized on exposure rather than on evidence of active attacks. The key mitigating reality is the attack surface: AV:N assumes the management portal is network-reachable to the attacker, which for a VoIP desk phone is normally a management VLAN or LAN rather than the public internet. CPE data is a placeholder (cpe:2.3:a:n/a:n/a) and EUVD affected-version data reads 'n/a n/a', so machine-readable product/version scoping is missing and must be taken from the free-text description (Fanvil x7a firmware 2.6.0.1182) - verify with vendor.

An attacker with network access to a Fanvil x7a phone's web management portal browses to the diagnostic ping tool and supplies a hostname field containing appended shell metacharacters. Because input is passed unsanitized to the underlying Android OS, the injected command executes without any authentication, giving the attacker code execution on the device. No public exploit was identified at time of analysis, but the low complexity (AC:L) makes weaponization straightforward.