CVE-2025-64055: Critical severity Fanvil x210 V2 vulnerability
An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to access administrative functions of the device (e.g. file upload, firmware update, reboot...) via a crafted authentication bypass.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fanvil x210 V2to a version that resolves this vulnerability.Fixed in 2.12.20 - Compensating control
Restrict access to the Fanvil x210 V2 administrative interface from the local network (e.g., allow only trusted management IPs) to limit exposure of unauthenticated access to admin functions (file upload, firmware update, reboot) described for the device.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64055?
CVE-2025-64055 is considered a critical vulnerability due to its ability to allow unauthenticated access to administrative functions on the device.
How do I fix CVE-2025-64055?
To mitigate CVE-2025-64055, it is recommended to restrict local network access to the device and apply any available firmware updates from Fanvil.
Who is affected by CVE-2025-64055?
Only users of the Fanvil x210 V2 running version 2.12.20 are affected by CVE-2025-64055.
What can attackers do with CVE-2025-64055?
Attackers can exploit CVE-2025-64055 to perform administrative functions such as file upload, firmware update, and device reboot without authentication.
Is there a workaround for CVE-2025-64055?
While there is no official workaround for CVE-2025-64055, limiting network access to trusted devices is advisable until a patch is provided.