CVE-2025-70521

critical · 9.8

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.

9.8

CVSS

0.4%

EPSS (exploit prob.)

37th

EPSS percentile

2026-10-07

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-77

References

http://download.fanvil.com/Firmware/Release/PA2S/
https://www.darkpoint.ca/blog/2026/02/27/Fanvil-x7a-PA2S-Vulnerability-Disclosure
https://www.fanvil.com/products/p5/wulianwangwangguan_1/20210921/5035.html

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-70521