CVE-2025-70521: Command Injection

Published Oct 7, 2026

Updated

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.

Affected Software

1 affected component

Fanvil x7a firmware=2.6.0.1182

Event History

Oct 7, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated attacker who can reach the management portal can exploit the diagnostic ping tool. The CVSS vector indicates network-based exploitation with no privileges or user interaction required.

What access does successful exploitation provide?

Successful command injection allows the attacker to run code on the device's underlying Android operating system. The reported impact includes high confidentiality, integrity, and availability impact.

How can I determine whether a device is affected?

The affected software identified in the report is Fanvil x7a firmware version 2.6.0.1182. Check the firmware version running on x7a devices and whether their management portal is reachable by untrusted networks.

CVE-2025-70521: Command Injection

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What access does successful exploitation provide?

How can I determine whether a device is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access does successful exploitation provide?

How can I determine whether a device is affected?