EUVD-2025-211047
GHSA-r46f-86rj-p44j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device websocket interface on network
-
ExploitOpen sessionless websocket connection
-
ExecutionIssue request without authentication
-
ImpactRetrieve operational logs / run diagnostics
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication is required: the device's websocket handler accepts sessionless users and exposes operational logs and diagnostic request functionality to anyone who can reach it, so exploitation needs only network connectivity to a Fanvil x7a running firmware 2.6.0.1182 - no credentials, configuration change, or user interaction. The practical limiting factor is network exposure: these management/websocket interfaces on VoIP/IoT gateway devices are typically deployed on internal or dedicated management networks rather than directly internet-facing, so reachability is the key gating condition rather than any authentication or feature toggle. Exploitation is also bound to the specific vulnerable firmware version 2.6.0.1182. |
| Impact | Signals conflict sharply here. The input CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) reflects a textbook unauthenticated network-reachable missing-authentication flaw (CWE-306), and the SSVC-style read is favorable to attackers: no authentication, low complexity, no user interaction. However, the EPSS score is very low (0.19%, 8th percentile), there is no CISA KEV listing, and no exploit code is identified in the provided data, so there is no evidence of widespread or automated exploitation - this reads as a low-probability, not-yet-weaponized issue despite the high base score. Two caveats materially lower real-world priority: (1) the I:H/A:H impact ratings appear overstated versus the description, which emphasizes viewing device resources (logs) and issuing diagnostic requests - primarily a confidentiality/information-disclosure problem rather than full compromise of integrity and availability; verify impact scope with the vendor. (2) The affected product (Fanvil x7a) is a niche VoIP/IoT gateway device whose websocket management interface is typically on an internal or management network, not internet-facing, which constrains the 'network' vector in practice. Net: a genuine authentication-bypass bug worth patching on exposed devices, but the headline 9.8 overstates urgency relative to the low EPSS, absent KEV, and limited realistic exposure. |
| Exploit ScenarioDerived | An attacker with network reachability to a Fanvil x7a device running firmware 2.6.0.1182 connects to its websocket handler without any session or credentials and issues requests that return operational logs or trigger diagnostic operations. Because no authentication is enforced (CVSS AV:N/AC:L/PR:N/UI:N), this requires only a single crafted connection with no user interaction. No public exploit code is identified in the provided data, though a third-party disclosure blog is referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Unauthenticated users who can reach the websocket handler on a Fanvil X7A device running firmware 2.6.0.1182 can read operational logs and issue diagnostic requests without ever establishing a session, because the handler does not enforce authentication for sessionless connections. The affected scope is narrowly defined: only that specific firmware build is reported, and exploitation requires nothing more than network reachability to the device's management websocket, with no credentials, user interaction, or configuration change (CVSS vector PR:N/UI:N, and the upstream advisory rates it 9.8). Signals around this issue conflict: MITRE scores it 9.8/C:H/I:H/A:H, while the independent assessment lands at 8.6 with C:H/I:L/A:L, and EPSS is low at 0.19% (8th percentile) with no public exploit code identified at time of analysis and no CISA KEV listing, so real-world risk is driven far more by whether the device is exposed than by current exploitation activity.
RemediationAI
No vendor-released patch with a specific version number was identified at time of analysis, so the primary action is to check Fanvil's firmware distribution page (http://download.fanvil.com/Firmware/Release/PA2S/) and the vendor product/advisory page (https://www.fanvil.com/products/p5/wulianwangwangguan_1/20210921/5035.html) for a firmware update newer than 2.6.0.1182 and to request a fixed build directly from Fanvil support, citing CVE-2025-70520 and the Dark Point disclosure (https://www.darkpoint.ca/blog/2026/02/27/Fanvil-x7a-PA2S-Vulnerability-Disclosure); upgrade as soon as a fixed image is available, since this is an authentication bypass that cannot be fully closed by configuration alone. Until then, the effective compensating control is reachability reduction: place affected X7A devices on a dedicated, tightly segmented management VLAN and apply firewall/ACL rules that allow the device's web/websocket management endpoint (HTTP/HTTPS-based; the exact port is not specified in the available data) only from a small set of trusted administrative hosts - the trade-off is that remote management, web UI access, and any browser-based provisioning from other subnets will break for anyone outside that allowlist. Where the device's management interface is not needed at all, disable or block external management access entirely and rely on local/console administration, accepting the operational cost of on-site access. Do not expose the management websocket to the internet or to general user VLANs, and monitor device logs for unexplained diagnostic or log-retrieval activity from unexpected source addresses, since the vulnerable functions are exactly the ones that generate those artefacts. Note that the 9.8 score in the upstream record versus the independently assessed 8.6 (C:H/I:L/A:L) means prioritization should be based on exposure - an internet- or guest-network-reachable device with vulnerable firmware is the urgent case, while an isolated, credentials-unreachable device on a management network is lower priority pending a patch.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a textbook CWE-306 (Missing Authentication for Critical Function): the websocket endpoint in Fanvil X7A firmware 2.6.0.1182 treats connections that do not present an authenticated session as valid clients, and then serves privileged back-end functions to them rather than rejecting or re-prompting. Websocket handlers are frequently bolted onto existing web management stacks and rely on the surrounding HTTP session/auth middleware; when a sessionless upgrade request reaches the handler directly, the middleware can be skipped entirely, leaving the handler to authorize the request on its own - which it does not do. Because the exposed functions include retrieval of operational logs and execution of diagnostic requests, an attacker obtains both sensitive operational telemetry (potentially including call detail, provisioning, or credential-adjacent entries) and an interactive diagnostic surface that may itself reveal further device internals. The CVSS 3.1 vector confirms the remote, unauthenticated nature of the issue (AV:N, AC:L, PR:N, UI:N); the discrepancy between the reported 9.8 and the independently assessed 8.6 (C:H/I:L/A:L) reflects disagreement over how much write/integrity and availability impact the diagnostic functions actually confer, not over the authentication bypass itself. The CPE metadata supplied in the source data is a placeholder (cpe:2.3:a:n/a:n/a), so product/version scoping must be taken from the advisory narrative rather than from CPE matching, and the vulnerable version is bound to firmware 2.6.0.1182 on the X7A. The reference set also points at Fanvil's PA2S firmware download location and a Dark Point disclosure blog, suggesting the underlying handler may ship across more than one Fanvil firmware family, which is worth verifying during triage.
Know when Fanvil gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network websocket access (AV:N/AC:L/PR:N/UI:N) yields high confidentiality from log/resource exposure, but description supports only limited integrity/availability impact from diagnostic requests, not I:H/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests.
Executive ViewAI
Fanvil X7A devices running firmware 2.6.0.1182 expose operational logs and diagnostic functions through a management websocket that accepts unauthenticated, sessionless access, so any device reachable from an untrusted network can be accessed without credentials or user action. No public exploit identified at time of analysis, but the exposure is critical because these devices often sit at network edges or in voice infrastructure, and unauthorized access could reveal sensitive operational data or enable disruptive diagnostics. Leadership should prioritize locating affected units and removing management-interface exposure until vendor remediation is available.
No vendor-released patch identified at time of analysis. Interim mitigations: block network access to the management websocket from untrusted networks; isolate Fanvil X7A devices on a dedicated management VLAN with strict firewall allowlists; disable remote management/websocket services if not required; restrict administrative access to authorized jump hosts; monitor for sessionless websocket or diagnostic activity; and contact Fanvil for fixed firmware or interim guidance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to access admi
A reflected Cross Site Scripting (XSS) vulnerability on Fanvil x210 2.12.20 devices allows attackers to cause a denial o
Directory traversal vulnerability in Fanvil x210 V2 2.12.20 allows unauthenticated attackers on the local network to sto
A Buffer overflow vulnerability on Fanvil x210 2.12.20 devices allows attackers to cause a denial of service or potentia
Unauthenticated command injection in the Fanvil X7A IP phone's web management portal (firmware 2.6.0.1182) lets any atta
Unauthenticated command injection in the Fanvil x7a IP phone's web management portal (firmware 2.6.0.1182) allows any at
Unauthenticated network access to the WebSocket handler on Fanvil X7A desk phones running firmware 2.6.0.1182 exposes de
An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to execute arb
Cross-site request forgery in the Fanvil X7A IP phone web management interface (firmware 2.6.0.1182) allows any state-ch
Cross-site request forgery in the Fanvil x7a IP desk phone (firmware 2.6.0.1182) lets an attacker who lures an authentic
File upload vulnerability in Fanvil x210 V2 2.12.20 allows unauthenticated attackers on the local network to store arbit
Reflected cross-site scripting in the Fanvil x7a IP phone firmware (2.6.0.1182) allows a remote, unauthenticated attacke
Exploit-DB