CVE-2025-70520CWE-306

CVE-2025-70520

Critical · published October 7, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
32.8
In the wild
Unconfirmed
What it is

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00397 · 32.8th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-10-07T19:16Z
References (4)
http://download.fanvil.com/Firmware/Release/PA2S/ · [email protected]https://www.darkpoint.ca/blog/2026/02/27/Fanvil-x7a-PA2S-Vulnerability-Disclosure · [email protected]https://www.fanvil.com/products/p5/wulianwangwangguan_1/20210921/5035.html · [email protected]https://www.darkpoint.ca/blog/2026/02/27/Fanvil-x7a-PA2S-Vulnerability-Disclosure · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 09 OCT 03:26Z
    EPSS moved — → 0%
    epss
  • 07 OCT 00:00Z
    The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users
    cvelistv5