CVEvulnerability

CVE-2025-70520

9.8 CRITICAL Published 2026-10-07 Modified 2026-10-26 Official page ↗
Status
Deferred
Published
2026-10-07
Last modified
2026-10-26
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-306

Description

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests.

Related

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References