External risk intelligence

Fanvil X210 Firmware Authentication Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-64055

The vulnerability affects an IP phone, which is typically deployed within an internal enterprise or local network. While the attack vector is network-based, these devices are designed to reside behind firewalls or within managed segments rather than being exposed directly to the public internet, making public exposure uncommon.

Authentication Bypass

Fanvil X210 Firmware

2.12.20

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An unauthenticated authentication bypass in Fanvil devices allows local network attackers to access administrative functions, such as file uploads and firmware updates. This vulnerability, rated critical, poses a significant risk if exploited due to its potential to compromise device integrity and control.

Unauthenticated local network access to device functions.
Critical risk of unauthorized administrative control.
Confirm relevance and exposure on internal networks.

Attack Path

How an attacker could exploit the issue

An attacker on the same local network could bypass authentication to gain administrative control over the device. This allows them to perform actions like uploading files, updating the firmware, or rebooting the phone.

No authentication needed for attack.
Crafted request bypasses authentication.
Admin access to device functions.

Live Threat

Current exploitation, exposure, and threat context

Attackers on the local network could access administrative functions of the Fanvil x210 device, such as file uploads, firmware updates, and reboots, through an authentication bypass. This could impact the device's behavior and configuration.

Device administrative functions.
Authentication bypass on local network.
Unauthorized device control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Fanvil IP phones, suggesting that ownership likely falls to teams managing end-user devices, unified communications infrastructure, or network security, depending on the deployment model. The first practical step is to identify all deployed Fanvil phones, assess their network exposure and business criticality, and then locate the accountable owner for remediation planning.

Identify accountable device owners.
Confirm network exposure and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Fanvil X210?

The Fanvil X210 is a high-end enterprise IP phone designed for professional business communications. It functions as a networked endpoint for voice services, commonly integrated into corporate unified communications systems to manage calls and contacts. Because these devices are essentially small computers with their own firmware, they contain administrative interfaces used by IT teams to configure settings, perform system updates, and maintain the phone's operational state.

How does CVE-2025-64055 function as a security weakness?

This vulnerability is classified as CWE-287, which refers to Improper Authentication. In plain terms, it means the device fails to properly verify the identity of a user attempting to access its administrative controls. Because of this flaw, the Fanvil X210 does not correctly require valid credentials, allowing an unauthorized person to bypass the login process entirely and interact with sensitive device functions.

Do I need to be directly in front of the phone to trigger this?

No, physical access to the device is not required. The vulnerability is triggered by sending a specially crafted request over the network. Crucially, the attack requires the attacker to be positioned on the same local network as the phone. Requests originating from outside the local network or across different network segments that do not have direct routing to the device will not successfully trigger this specific flaw.

Is my Fanvil X210 at risk?

Halo Surface Signal indicates that while this is a network-based vulnerability, the risk is typically localized. Because these IP phones are designed to reside within internal enterprise segments or behind firewalls rather than the public internet, they are not usually exposed to external attackers. You should primarily be concerned if your devices are connected to less secure network segments where unauthorized users or compromised internal systems could reach them.

When should I take action for this Fanvil vulnerability?

You should begin by auditing your network to identify all deployed Fanvil X210 units and confirming their firmware versions. Since this flaw allows for unauthorized administrative actions like file uploads or reboots, prioritize devices that handle sensitive communications or are placed on accessible network segments. Once identified, work with the team responsible for unified communications or network infrastructure to plan updates or isolate the devices from untrusted traffic.

References

github.com/SpikeReply/advisories/blob/main/cve/fanvil/cve-2025-6…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.