Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2025-70518: Fanvil x7a firmware ping tool lets attackers run code
CVE-2025-70518 · published 11 days ago
Summary
The ping feature in the Fanvil x7a phone firmware (version 2.6.0.1182) does not check the data it receives, so a stranger could send specially crafted input and cause the phone to execute commands on its Android base system. This could let an unauthenticated attacker take control of the device or disrupt its operation. Update the firmware to a version that fixes the input handling or disable the diagnostic ping tool until a patch is applied.
Original advisory text
The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticate...
The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
10.0
Critical
Type
CWE-77Command Injection
Timeline
Published7 Oct 2026
Updated15 Oct 2026
First seen7 Oct 2026
Track software like this
Free during beta