CVE-2025-70521
9.8 CRITICALPublished 2026-10-07 · Updated 2026-10-07
AI risk analysis
- Summary
- The flaw allows unauthenticated attackers to inject commands and execute code on the underlying Android operating system, due to insecure user input handling in the diagnostic ping tool.
- Exploitability
- Exploitation is relatively straightforward as no authentication is required, and the tool is accessible via the management portal.
- Blast radius
- If exploited, the attacker could gain full control over the device and potentially the entire network it is connected to.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to firmware version 2.6.0.1183 or later.
rceunauthwebfirmware
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-77
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- CRITICALCVE-2025-70518
- CRITICALCVE-2026-108917PoC
- CRITICALCVE-2023-54399
- CRITICALCVE-2023-54405PoC
- CRITICALCVE-2026-100291
- CRITICALCVE-2026-102427
- HIGHCVE-2026-104457PoC
- HIGHCVE-2026-105115PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.