CVE-2025-70522

The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the applications. Due to the lack of protection, cross-origin boundary can be completely bypassed, allowing for Cross-Site Request Forgery Attacks against any endpoint.

CVSS 3.1

8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.2% chance of exploitation in the next 30 days; higher than 9% of CVEs (scores of 2026-10-25)

CWE

CWE-352

Published

2026-10-07

Modified

2026-10-09

Record from

the NVD, synced 2026-10-19

References

• http://download.fanvil.com/Firmware/Release/PA2S/
• https://www.darkpoint.ca/blog/2026/02/27/Fanvil-x7a-PA2S-Vulnerability-Disclosure
• https://www.fanvil.com/products/p5/wulianwangwangguan_1/20210921/5035.html
• https://www.darkpoint.ca/blog/2026/02/27/Fanvil-x7a-PA2S-Vulnerability-Disclosure

Check your stackJSON