CVE-2025-70520

Der Websocket-Handler der Firmware-Version 2.

Description

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests.

Source: cvelistv5 NVD (NIST)

Metrics

EPSS percentile

7.7 %

Low — this CVE sits in the lower 10% of all CVEs scored today.

KEV status

—

Show all metrics

Severity

none

Priority score

30.48

Exploit maturity

no public PoC known

EPSS score

0.2 %

Low — model estimates < 1% exploitation likelihood.

Published

2026-10-07 00:00 UTC

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

New CVE Received2026-10-07 15:16 UTC· cve@mitre.org
- Description: The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests.
- Affected: New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2025/70xxx/CVE-2025-70520.json">CVE-2025-70520</a>
- Reference: http://download.fanvil.com/Firmware/Release/PA2S/
- Reference: https://www.darkpoint.ca/blog/2026/02/27/Fanvil-x7a-PA2S-Vulnerability-Disclosure