8
CVEs
4
Critical
2
High
0
KEV
0
PoC
6
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
4
HIGH
2
MEDIUM
2
LOW
0
Monthly CVE Trend
Affected Products (3)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-70518 | Unauthenticated command injection in the Fanvil X7A IP phone's web management portal (firmware 2.6.0.1182) lets any attacker who can reach the diagnostic ping tool execute arbitrary commands with the privileges of the underlying Android operating system, resulting in total device compromise (CVSS 10.0, scope-changed, S:C). No credentials or user interaction are required (PR:N/UI:N), publicly available exploit code exists, and CISA's SSVC assessment rates the flaw fully automatable with total technical impact, so any deployment with the portal reachable from untrusted or flat networks should be assumed exploitable at scale. In correctly segmented environments the real-world attacker population is limited to hosts with management-VLAN or LAN reachability to the phone's portal. | CRITICAL | 10.0 | 0.6% | 50 |
No patch
|
| CVE-2025-70520 | Unauthenticated users who can reach the websocket handler on a Fanvil X7A device running firmware 2.6.0.1182 can read operational logs and issue diagnostic requests without ever establishing a session, because the handler does not enforce authentication for sessionless connections. The affected scope is narrowly defined: only that specific firmware build is reported, and exploitation requires nothing more than network reachability to the device's management websocket, with no credentials, user interaction, or configuration change (CVSS vector PR:N/UI:N, and the upstream advisory rates it 9.8). Signals around this issue conflict: MITRE scores it 9.8/C:H/I:H/A:H, while the independent assessment lands at 8.6 with C:H/I:L/A:L, and EPSS is low at 0.19% (8th percentile) with no public exploit code identified at time of analysis and no CISA KEV listing, so real-world risk is driven far more by whether the device is exposed than by current exploitation activity. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2025-70521 | Unauthenticated command injection in the Fanvil x7a IP phone's web management portal (firmware 2.6.0.1182) allows any attacker who can reach the portal's diagnostic ping tool to inject shell metacharacters and execute arbitrary commands on the underlying Android operating system, compromising confidentiality, integrity and availability equally (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). The practical gating factor is exposure: the portal is normally reachable only from a LAN or management VLAN, so risk falls sharply wherever it is not reachable from untrusted networks. No public exploit code or confirmed in-the-wild activity has been identified at time of analysis - CISA's SSVC rates Exploitation as 'none' while classifying the flaw as automatable with total technical impact, meaning exploitation could spread quickly once a proof-of-concept surfaces. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2025-70516 | Unauthenticated network access to the WebSocket handler on Fanvil X7A desk phones running firmware 2.6.0.1182 exposes device internals: any client able to reach the interface can read operational logs and issue diagnostic requests without a session, credentials, or user interaction (CWE-306, missing authentication for a critical function). NVD rates this 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), while the independent assessment adjusts integrity impact to Low (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) and treats the exposure as a genuine access-control flaw rather than a top-tier emergency. No public exploit code was identified at time of analysis and CISA's SSVC decision point records no observed exploitation, so practical risk hinges on whether the phone's WebSocket/management interface is reachable beyond the local VoIP VLAN. | CRITICAL | 9.1 | 0.3% | 46 |
No patch
|
| CVE-2025-70522 | Cross-site request forgery in the Fanvil x7a IP desk phone (firmware 2.6.0.1182) lets an attacker who lures an authenticated administrator to attacker-controlled web content silently perform any state-changing action on the device's web management interface, since the request handler enforces no CSRF token, origin, or referer checks. Exploitation is not self-triggering: it requires a live admin session (CVSS vector is PR:N/UI:R, so the attacker needs no credentials of their own but does need the victim's authenticated browser and a reachable management interface, typically on the same LAN). No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; EPSS is 0.16% (5th percentile), and the signals conflict - the high base score and complete absence of cross-origin protection are offset by user-interaction, session and network-reachability prerequisites. A public technical disclosure exists (DarkPoint, February 2026) and references also point to Fanvil PA2S firmware, suggesting the affected web stack may span more than the x7a model. | HIGH | 8.8 | 0.2% | 44 |
No patch
|
| CVE-2025-70517 | Cross-site request forgery in the Fanvil X7A IP phone web management interface (firmware 2.6.0.1182) allows any state-changing endpoint to be invoked from an attacker-controlled web page, because the request handler enforces no anti-CSRF token and no origin/referer validation. The flaw is network-reachable and requires no attacker authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R), but it can only be triggered while a victim administrator holds an active authenticated management session and is lured into visiting the malicious page; the forged requests succeed silently against the phone. Impact is bounded to what the admin's privileges permit - configuration, account, provisioning, or availability-affecting actions - and, per this assessment (C:N on the assessed vector), no confidential response data can be read back due to same-origin policy. Exploitation likelihood is currently low (EPSS 0.16%, ~5th percentile); there is no CISA KEV listing and no public exploit identified at time of analysis, though a third-party disclosure write-up exists. | HIGH | 8.8 | 0.2% | 44 |
No patch
|
| CVE-2025-70519 | Reflected cross-site scripting in the Fanvil x7a IP phone firmware (2.6.0.1182) allows a remote, unauthenticated attacker to inject HTML and JavaScript into the device log component, which then executes in the browser of any user who opens the affected log view - in practice an administrator using the phone's web management interface. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting that exploitation requires user interaction (the victim must render the log page) while the injected script runs in a scope beyond the vulnerable component, though confidentiality and integrity impact is limited to the viewer's browser session rather than the underlying device OS. No public exploit code has been identified at time of analysis and the issue is not listed on CISA KEV, so risk is currently tied to exposure of the management interface rather than observed exploitation. | MEDIUM | 6.1 | 0.2% | 31 |
No patch
|
| CVE-2025-70515 | Reflected cross-site scripting in the Fanvil X7A IP phone's device log component (firmware 2.6.0.1182) lets an attacker inject HTML into log data that the web interface renders without sanitization, so malicious JavaScript executes in the browser of whoever views that log page. The attack is network-reachable but requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1), and in practice an operator likely has to open the log view from the phone's administrative web interface, which narrows real-world exposure. Risk signals are low: EPSS is 0.18% (7th percentile), there is no CISA KEV entry, and no public exploit code has been identified at time of analysis - only a third-party vulnerability disclosure writeup. | MEDIUM | 6.1 | 0.2% | 31 |
No patch
|