CVE-2025-70516

Summary

The websocket handler in Fanvil x7a firmware version 2.6.0.1182 lacks proper authentication, allowing unauthorized access to device resources such as operational logs and diagnostic requests.

Exploitability

Exploitation is relatively straightforward as no authentication is required, and the lack of preconditions makes it accessible to anyone with network access.

Blast radius

If exploited, attackers could gain full access to sensitive device information, potentially leading to operational disruptions or data exfiltration.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version 2.6.0.1183 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.