CVE-2025-70522: Fanvil x7a firmware vulnerability

Published Oct 7, 2026

Updated

The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the applications. Due to the lack of protection, cross-origin boundary can be completely bypassed, allowing for Cross-Site Request Forgery Attacks against any endpoint.

Affected Software

1 affected component

Fanvil x7a firmware=2.6.0.1182

Event History

Oct 7, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·03:16 PM

Description

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to cause a user’s browser to send cross-origin requests to the affected device. The firmware does not enforce cross-origin request protection for state-changing requests, so CSRF attacks can target any endpoint.

Are state-changing endpoints selectively protected?

No. The affected request handler lacks cross-origin protection for any state-changing request, allowing the cross-origin boundary to be bypassed across application endpoints.

CVE-2025-70522: Fanvil x7a firmware vulnerability

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Are state-changing endpoints selectively protected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Are state-changing endpoints selectively protected?