CVE-2025-70517

Summary

The flaw allows Cross-Site Request Forgery Attacks due to the lack of cross-origin resource protection in the Fanvil x7a firmware version 2.6.0.1182, enabling unauthorized state-changing requests.

Exploitability

Exploitation is relatively straightforward as it requires a cross-origin request to a state-changing endpoint, which can be achieved through social engineering or by tricking a user into clicking a malicious link.

Blast radius

If exploited, this can lead to unauthorized access and control of the affected device, potentially leading to data exfiltration or device compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Fanvil x7a firmware version 2.6.0.1182 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.