Fanvil x7a/PA2S Firmware Multiple Vulnerabilities Advisory (RCE/CSRF/XSS/CVE-2025-70515-70522)

Vulnerability Overview 1. WebSocket Command Injection (CVE-2025-70518 / CVE-2025-70521) Vulnerability Type: Command Injection Affected Scope: Fanvil x7a Android Phone 2.6.0.1182 and Fanvil PA2S SIP Gateway 2.12.44.9 Description: The diagnostic ping tool in the management portal fails to securely handle user-supplied input, allowing unauthenticated attackers to inject commands and execute code on the Android operating system. Attack Vector: An unauthenticated remote attacker can execute arbitrary shell commands by sending crafted WebSocket requests to the diagnostic ping tool. Impact: Code Execution, Information Disclosure 2. WebSocket Broken Access Control (CVE-2025-70516 / CVE-2025-70520) Vulnerability Type: Broken Access Control Affected Scope: Fanvil x7a Android Phone 2.6.0.1182 and Fanvil PA2S SIP Gateway 2.12.44.9 Description: The WebSocket handlers in Fanvil x7a firmware version 2.6.0.1182 and PA2S firmware version 2.12.44.9 do not enforce appropriate authentication restrictions for users without a session. This lack of restriction allows anyone to view any device resource, such as operation logs or execute diagnostic requests. Attack Vector: An unauthenticated remote attacker can access device resources via WebSocket connection without requiring user credentials. Impact: Information Disclosure 3. Cross-Site Scripting (CVE-2025-70515 / CVE-2025-70519) Vulnerability Type: Cross-Site Scripting Affected Scope: Fanvil x7a Android Phone 2.6.0.1182 and Fanvil PA2S SIP Gateway 2.12.44.9 Description: The device log component in Fanvil x7a firmware version 2.6.0.1182 and PA2S firmware version 2.12.44.9 fails to properly sanitize or encode reflected user-supplied data. The lack of sanitization allows HTML injection, which can be used to execute malicious JavaScript code in any target browser, thereby compromising the device log component. Attack Vector: An unauthenticated remote attacker can inject JavaScript code by sending crafted requests to the management portal's log tool. Impact: Information Disclosure 4. Cross-Site Request Forgery (CVE-2025-70517 / CVE-2025-70522) Vulnerability Type: Cross-Site Request Forgery Affected Scope: Fanvil x7a Android Phone 2.6.0.1182 and Fanvil PA2S SIP Gateway 2.12.44.9 Description: The WebSocket handler for the device log component in Fanvil x7a firmware version 2.6.0.1182 and PA2S firmware version 2.12.44.9 does not enforce any Cross-Origin Resource Sharing (CORS) protections for state-changing requests. Due to the lack of protection, cross-origin boundaries can be completely bypassed, allowing Cross-Site Request Forgery (CSRF) attacks against any endpoint. Attack Vector: An unauthenticated remote attacker, by tricking an administrator user into visiting a malicious website (typically through normal "Web surfing" activities or shared links), can perform any request on the application using the authenticated administrator session. Impact: Information Disclosure Affected Scope Affected Products: - Fanvil x7a Android Phone 2.6.0.1182 - Fanvil PA2S SIP Gateway 2.12.44.9 Remediation Recommended Measures: - Update firmware to the latest version to fix the aforementioned vulnerabilities. - Implement appropriate input validation and sanitization mechanisms to prevent command injection and Cross-Site Scripting (XSS) attacks. - Strengthen access controls to ensure that only authenticated users can access sensitive resources. - Implement Cross-Site Request Forgery (CSRF) protection mechanisms, such as CSRF tokens, to prevent unauthorized requests. Proof of Concept (POC) Code WebSocket Command Injection WebSocket Broken Access Control Cross-Site Scripting Cross-Site Request Forgery

Goal Reached Thanks to every supporter — we hit 100%!

Fanvil x7a/PA2S Firmware Multiple Vulnerabilities Advisory (RCE/CSRF/XSS/CVE-2025-70515-70522)