{"schemaVersion":2,"id":"CVE-2025-70520","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests.","dates":{"published":"2026-10-07T00:00:00.000Z","modified":"2026-10-15T19:06:37.126Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00188,"percentile":0.07839,"severity":"low","asOf":"2026-10-15T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-08T00:00:00.000Z","score":0.00188,"percentile":0.07707},{"date":"2026-10-09T00:00:00.000Z","score":0.00188,"percentile":0.07719},{"date":"2026-10-10T00:00:00.000Z","score":0.00188,"percentile":0.07735},{"date":"2026-10-11T00:00:00.000Z","score":0.00188,"percentile":0.07739},{"date":"2026-10-12T00:00:00.000Z","score":0.00188,"percentile":0.07734},{"date":"2026-10-13T00:00:00.000Z","score":0.00188,"percentile":0.07803},{"date":"2026-10-14T00:00:00.000Z","score":0.00188,"percentile":0.07832},{"date":"2026-10-15T00:00:00.000Z","score":0.00188,"percentile":0.07839}],"last30":[{"date":"2026-10-08T00:00:00.000Z","score":0.00188,"percentile":0.07707},{"date":"2026-10-09T00:00:00.000Z","score":0.00188,"percentile":0.07719},{"date":"2026-10-10T00:00:00.000Z","score":0.00188,"percentile":0.07735},{"date":"2026-10-11T00:00:00.000Z","score":0.00188,"percentile":0.07739},{"date":"2026-10-12T00:00:00.000Z","score":0.00188,"percentile":0.07734},{"date":"2026-10-13T00:00:00.000Z","score":0.00188,"percentile":0.07803},{"date":"2026-10-14T00:00:00.000Z","score":0.00188,"percentile":0.07832},{"date":"2026-10-15T00:00:00.000Z","score":0.00188,"percentile":0.07839}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-306","name":"Missing Authentication for Critical Function","description":"The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/306.html","capec":[{"id":"CAPEC-12","name":"Choosing Message Identifier","url":"https://capec.mitre.org/data/definitions/12.html"},{"id":"CAPEC-166","name":"Force the System to Reset Values","url":"https://capec.mitre.org/data/definitions/166.html"},{"id":"CAPEC-216","name":"Communication Channel Manipulation","url":"https://capec.mitre.org/data/definitions/216.html"},{"id":"CAPEC-36","name":"Using Unpublished Interfaces or Functionality","url":"https://capec.mitre.org/data/definitions/36.html"},{"id":"CAPEC-62","name":"Cross Site Request Forgery","url":"https://capec.mitre.org/data/definitions/62.html"}],"techniques":[],"countermeasures":[]}],"ttp":{"capecs":[{"id":"CAPEC-12","name":"Choosing Message Identifier","url":"https://capec.mitre.org/data/definitions/12.html","weaknessIds":["CWE-306"],"techniqueIds":[]},{"id":"CAPEC-166","name":"Force the System to Reset Values","url":"https://capec.mitre.org/data/definitions/166.html","weaknessIds":["CWE-306"],"techniqueIds":[]},{"id":"CAPEC-216","name":"Communication Channel Manipulation","url":"https://capec.mitre.org/data/definitions/216.html","weaknessIds":["CWE-306"],"techniqueIds":[]},{"id":"CAPEC-36","name":"Using Unpublished Interfaces or Functionality","url":"https://capec.mitre.org/data/definitions/36.html","weaknessIds":["CWE-306"],"techniqueIds":[]},{"id":"CAPEC-62","name":"Cross Site Request Forgery","url":"https://capec.mitre.org/data/definitions/62.html","weaknessIds":["CWE-306"],"techniqueIds":[]}],"techniques":[],"countermeasures":[],"countermeasuresByTactic":[]},"affected":[],"affectedCount":0,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.fanvil.com/products/p5/wulianwangwangguan_1/20210921/5035.html","label":"www.fanvil.com/products/p5/wulianwangwangguan_1/20210921/5035.html","hostname":"www.fanvil.com","tags":[]},{"url":"http://download.fanvil.com/Firmware/Release/PA2S/","label":"download.fanvil.com/Firmware/Release/PA2S/","hostname":"download.fanvil.com","tags":[]},{"url":"https://www.darkpoint.ca/blog/2026/02/27/Fanvil-x7a-PA2S-Vulnerability-Disclosure","label":"www.darkpoint.ca/blog/2026/02/27/Fanvil-x7a-PA2S-Vulnerability-Disclosure","hostname":"www.darkpoint.ca","tags":[]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-07T00:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-15T19:06:37.126Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-15T22:54:15.172Z","stale":false,"partial":false}}