Critical severity · published Oct 7, 2026
CVE-2025-70516
The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users
9.1
CVSS
0.3%
EPSS
No
On KEV
Description
The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-70516
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-70516
www.fanvil.com
https://www.fanvil.com/products/p1/x/20210921/5043.html
download.fanvil.com
http://download.fanvil.com/Firmware/Release/X7A/
www.darkpoint.ca
https://www.darkpoint.ca/blog/2026/02/27/Fanvil-x7a-PA2S-Vulnerability-Disclosure