What’s Vulnerable › Vulnerabilities

CVE-2025-70518

• Severity: critical (CVSS 10.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-07 · updated 2026-10-07
• Weakness: CWE-77

Description

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.

References

• http://download.fanvil.com/Firmware/Release/X7A/
• https://www.darkpoint.ca/blog/2026/02/27/Fanvil-x7a-PA2S-Vulnerability-Disclosure
• https://www.fanvil.com/products/p1/x/20210921/5043.html
• https://www.darkpoint.ca/blog/2026/02/27/Fanvil-x7a-PA2S-Vulnerability-Disclosure

Get alerted when CVE-2025-70518 or the next vulnerability affects your stack