CVE-2025-70518

CVSS 10.0 (critical) · published 2026-10-07

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.

Weakness: CWE-77

Source: NVD CVE-2025-70518

References

• http://download.fanvil.com/Firmware/Release/X7A/
• https://www.darkpoint.ca/blog/2026/02/27/Fanvil-x7a-PA2S-Vulnerability-Disclosure
• https://www.fanvil.com/products/p1/x/20210921/5043.html
• https://www.darkpoint.ca/blog/2026/02/27/Fanvil-x7a-PA2S-Vulnerability-Disclosure

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.