Fanvil x7a CVE-2025-70522

Exploitation requires that a user with an authenticated administrative session to the Fanvil x7a (firmware 2.6.0.1182) web request handler visit attacker-controlled web content while that session is active; because no CSRF token or cross-origin protection is enforced on any state-changing endpoint, the device is vulnerable in its default configuration. Limiting factors: the victim must be logged into the device (active session), must perform the interaction of loading the malicious page (CVSS UI:R), and the device's web management interface must be reachable from the victim's browser (typically same LAN/management network rather than the public internet). These constraints make exploitation opportunistic and victim-dependent rather than remotely self-triggering.

Signals conflict and should be weighed carefully. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8 'High') paints a severe picture: network-reachable, low-complexity, no attacker privileges. However, UI:R correctly reflects that this CSRF requires a victim - specifically an administrator with an active authenticated session to the Fanvil x7a web interface - to visit attacker-controlled content, which materially limits mass/automated exploitation. The EPSS score is low (0.16%, 5th percentile), there is no CISA KEV listing, and no public exploit is confirmed in the provided data, so there is no evidence of active or widespread exploitation. I also note the vendor-style impact rating of C:H/I:H/A:H is aggressive for a classic CSRF: same-origin policy normally prevents the attacker from reading responses, so direct confidentiality impact is weaker than rated (impact here is primarily integrity via forced configuration changes, with downstream confidentiality/availability). Net: this is a legitimate issue for organizations that actually deploy Fanvil x7a devices with web management exposed to admin browsers, but it is a targeted/opportunistic risk rather than a broadly automatable internet-scale threat - not a drop-everything priority absent evidence of exploitation.

An attacker lures a logged-in Fanvil x7a administrator to a malicious web page while that admin has an active session to the device's web interface. The page silently auto-submits forged cross-origin requests to state-changing endpoints (e.g., altering call routing/forwarding or administrative settings) which execute without any CSRF validation. No public exploit is confirmed in the provided data, though a vendor-independent disclosure write-up (darkpoint.ca) is referenced and may contain technical detail; CVSS AC:L/UI:R indicates the attack is technically simple but depends on victim interaction.