CVE-2025-70517: Fanvil x7a firmware vulnerability

Published Oct 7, 2026

Updated

The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the applications. Due to the lack of protection, cross-origin boundary can be completely bypassed, allowing for Cross-Site Request Forgery Attacks against any endpoint.

Affected Software

1 affected component

Fanvil x7a firmware=2.6.0.1182

Event History

Oct 7, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·03:16 PM

Description

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker needs to cause a user of the affected device's web application to make a cross-origin request. Because state-changing endpoints do not enforce cross-origin request protection, the request can target any endpoint.

Which deployments are exposed?

Fanvil x7a devices running firmware version 2.6.0.1182 are identified as affected. The available information does not describe configuration prerequisites or exceptions.

CVE-2025-70517: Fanvil x7a firmware vulnerability

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which deployments are exposed?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which deployments are exposed?