CVE-2025-70522
8.8 HIGHPublished 2026-10-07 · Updated 2026-10-09
AI risk analysis
- Summary
- The firmware of Fanvil x7a version 2.6.0.1182 lacks cross-origin resource protection, enabling Cross-Site Request Forgery (CSRF) attacks.
- Exploitability
- Exploitation is relatively straightforward as it requires the attacker to trick the victim into performing a state-changing action on their behalf.
- Blast radius
- If exploited, the attack could lead to unauthorized changes to the victim's account or device settings, with high impact on data integrity and user control.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to Fanvil x7a firmware version 2.6.0.1183 or later.
csrfwebfirmware
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the applications. Due to the lack of protection, cross-origin boundary can be completely bypassed, allowing for Cross-Site Request Forgery Attacks against any endpoint.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- CRITICALCVE-2025-15399
- HIGHCVE-2025-70517
- HIGHCVE-2026-101147
- HIGHCVE-2026-104059PoC
- HIGHCVE-2026-104448PoC
- HIGHCVE-2026-107809PoC
- HIGHCVE-2026-108553PoC
- HIGHCVE-2026-39718
Related by shared AI tags and CWE weakness class. Browse the full archive.