CVE-2025-70521

Published 7 October 2026 · tracked since 8 October 2026

Description

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-107204 CRITICAL 9.8
• CVE-2026-106559 MEDIUM 6.3
• CVE-2026-106560 HIGH 7.1
• CVE-2026-106561 MEDIUM 5
• CVE-2026-106563 MEDIUM 5.3
• CVE-2026-106558 HIGH 8.8
• CVE-2026-106510 HIGH 7.7
• CVE-2026-106556 HIGH 7.7
• CVE-2025-70518 CRITICAL 10
• CVE-2026-107177 MEDIUM 5.9

→ Open the live CVE board · all tools