CVE-2025-70518
10 CRITICALPublished 2026-10-07 · Updated 2026-10-07
AI risk analysis
- Summary
- The flaw allows unauthenticated attackers to inject commands and execute code on the underlying Android operating system, leading to remote code execution.
- Exploitability
- Exploitation is relatively easy as it requires no authentication and can be done via the diagnostic ping tool.
- Blast radius
- If exploited, the impact could be severe, allowing full control over the device and potentially the network it is connected to.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to firmware version 2.6.0.1183 or later.
rceunauthwebfirmware
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-77
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- CRITICALCVE-2025-70521
- CRITICALCVE-2026-108917PoC
- CRITICALCVE-2023-54399
- CRITICALCVE-2023-54405PoC
- CRITICALCVE-2026-100291
- CRITICALCVE-2026-102427
- HIGHCVE-2026-104457PoC
- HIGHCVE-2026-105115PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.