CVE-2025-70521
Deferred Deferred - Pending Action

Command Injection in Fanvil x7a Firmware

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: MITRE

Description
The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-07
AI Q&A
2026-10-07
EPSS Evaluated
N/A
NVD
CVE-2025-70521
EUVD
EUVD-2025-211046

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a n/a n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Fanvil x7a firmware version 2.6.0.1182 has a vulnerability in its management portal's diagnostic ping tool. This flaw allows unauthenticated attackers to inject commands into the system. These commands can then be executed in the underlying Android operating system, potentially giving attackers control over the device.

Detection Guidance

Check if Fanvil x7a devices are running firmware version 2.6.0.1182. Inspect network traffic for unauthorized command injection attempts targeting the management portal's diagnostic ping tool. Monitor Android system logs for unexpected command executions.

Impact Analysis

This vulnerability could allow attackers to execute arbitrary code on your Fanvil x7a device. This might lead to unauthorized access, data theft, or disruption of device operations. Since the device runs on Android, attackers could leverage this to install malware or gain persistent control.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection. Organizations using affected devices may face compliance breaches, legal penalties, and reputational damage due to potential data exposure or loss.

Mitigation Strategies

Update Fanvil x7a firmware to a patched version if available. Disable the diagnostic ping tool in the management portal if possible. Restrict network access to the management portal to trusted IPs only. Monitor for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-70521. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart