Fanvil X7A EUVD-2025-211051

The websocket handler of Fanvil X7A firmware version 2.6.0.1182 fails to enforce session/authentication restrictions, so exploitation requires only network reachability to the device's websocket/management interface - no credentials, session, or user interaction. The practical limiting factor is network exposure: these IP phones typically sit on internal/VoIP VLANs, so impact depends on whether the management interface is reachable from the attacker's position (adjacent LAN vs. exposed WAN). Exploitation is tied to this specific firmware version and the X7A product; devices on other firmware or with the websocket interface network-isolated are not reachable.

Signals are mixed but collectively point to a genuine access-control flaw rather than a top-tier emergency. The CVSS 3.1 base score of 9.1 is driven by a fully remote, low-complexity, unauthenticated vector (AV:N/AC:L/PR:N/UI:N) with high confidentiality and integrity impact, which aligns with CWE-306 (Missing Authentication for Critical Function). SSVC reinforces this on technical severity: Automatable=yes and Technical Impact=total indicate a reliably scriptable attack with significant device compromise. However, SSVC Exploitation is explicitly 'none,' there is no CISA KEV listing and no POC referenced, and no EPSS score was provided - so there is currently no evidence of real-world exploitation, only strong theoretical exploitability. Note a tension between the CVSS impact scoring and the description: the description emphasizes reading device resources/logs and issuing diagnostic requests (clearly a confidentiality exposure), whereas the I:H integrity rating in the input vector is not strongly substantiated by the described capabilities - verify with the vendor advisory whether diagnostic requests can alter device state. Net assessment: a legitimately serious authentication-bypass bug on an exposed VoIP endpoint, but one whose practical urgency is tempered by the niche affected product and the absence of any confirmed exploitation or public exploit.

An attacker with network reachability to a Fanvil X7A phone's management/web interface connects directly to the device websocket handler without establishing an authenticated session, and because sessionless users are not restricted, retrieves operational logs and issues diagnostic requests. This exposes sensitive device and network information and potentially device state changes. No public exploit code is identified, but the flaw is low-complexity and scriptable (SSVC Automatable=yes).