What is the CVSS score of EUVD-2025-201424?

EUVD-2025-201424 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of X210 Firmware are affected by EUVD-2025-201424?

Fanvil x210 IP phone devices (version 2.12.20) contain a critical vulnerability that allows attackers to execute arbitrary commands or disable phones through specially crafted requests.

Is there a public PoC exploit available for EUVD-2025-201424?

Yes, a public proof-of-concept exploit is available for EUVD-2025-201424. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2025-201424?

Within 24 hours: Inventory all Fanvil x210 devices running version 2.12.20 and isolate them to a segmented network if possible. Within 7 days: Implement WAF rules to block POST requests to /cgi-bin/webconfig endpoints and restrict access to this endpoint to trusted internal IP ranges only. Within 30 days: Contact Fanvil for patched firmware availability and develop a staged deployment plan; if no patch is released, evaluate replacement or decommissioning of affected devices.

X210 Firmware EUVD-2025-201424

| CVE-2025-64054 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2025-12-05 cve@mitre.org

XSS Denial Of Service X210 Firmware

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 17:08 euvd

EUVD-2025-201424

Analysis Generated

Mar 15, 2026 - 17:08 vuln.today

PoC Detected

Jan 09, 2026 - 02:17 vuln.today

Public exploit code

CVE Published

Dec 05, 2025 - 16:15 nvd

CRITICAL 9.6

DescriptionCVE.org

A reflected Cross Site Scripting (XSS) vulnerability on Fanvil x210 2.12.20 devices allows attackers to cause a denial of service or potentially execute arbitrary commands via crafted POST request to the /cgi-bin/webconfig?page=upload&action=submit endpoint.

Analysis

Technical ContextAI

Cross-site scripting (XSS) allows injection of client-side scripts into web pages viewed by other users due to insufficient output encoding.

RemediationAI

Encode all user-supplied output contextually (HTML, JS, URL). Implement Content Security Policy (CSP) headers. Use HTTPOnly and Secure cookie flags.

EUVD-2025-201424 vulnerability details – vuln.today

Back

X210 Firmware EUVD-2025-201424

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

Share

External POC / Exploit Code