CRITICAL 10.0 NVD
CVE-2025-70518
The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user inp
The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.
References
- http://download.fanvil.com/Firmware/Release/X7A/
- https://www.darkpoint.ca/blog/2026/02/27/Fanvil-x7a-PA2S-Vulnerability-Disclosure
- https://www.fanvil.com/products/p1/x/20210921/5043.html
- https://www.darkpoint.ca/blog/2026/02/27/Fanvil-x7a-PA2S-Vulnerability-Disclosure
This critical severity vulnerability with a CVSS score of 10.0 was published on 2026-10-07 via NVD.
Risk Timeline
CVE Disclosed2026-10-07 · 4 days ago
Remediation Resources
Official Advisory
download.fanvil.com/Firmware/Release/X7A/Analysis & PoC
www.fanvil.com/products/p1/x/20210921/5043.html
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.