Intel

CVE-2025-70516

Der Websocket-Handler der Firmware-Version 2.

criticalEPSS 0.3%

Description

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests.

Source: cvelistv5NVD (NIST)

Metrics

XIEM Effective CVSS
9.1
Source: cna-v3
EPSS percentile
23.8 %
Elevated — this CVE ranks above at least 10% of all CVEs scored today.
KEV status
—
Show all metrics
Severity
critical
Priority score
80.04
Exploit maturity
no public PoC known
CVSS v3
9.1
EPSS score
0.3 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-10-07 00:00 UTC

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-10-07 21:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • CVSS V3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    • CWE: CWE-306
    • SSVC: {"id":"CVE-2025-70516","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technical…
  2. New CVE Received2026-10-07 15:16 UTC· cve@mitre.org
    • Description: The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests.
    • Affected: New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2025/70xxx/CVE-2025-70516.json">CVE-2025-70516</a>
    • Reference: http://download.fanvil.com/Firmware/Release/X7A/
    • Reference: https://www.darkpoint.ca/blog/2026/02/27/Fanvil-x7a-PA2S-Vulnerability-Disclosure