External risk intelligence

Fanvil X7a Firmware Websocket Handler Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2025-70516

The vulnerability affects a websocket handler in an IP phone, which is typically deployed within an internal enterprise or local network. While the device handles network traffic, these endpoints are generally not designed to be directly exposed to the public internet, though they may be reachable if improperly configured or exposed via insecure gateways.

Missing Authentication

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in a specific firmware version of Fanvil IP phones, impacting their websocket handler. The flaw allows unauthenticated access to device resources, including operational logs and diagnostic functions, potentially exposing sensitive information and operational data. The main concern is confirming relevance and exposure within our environment.

Unauthenticated access to phone logs and functions.
Confirms if our phones are affected.
Assess impact and exposure in our network.

Attack Path

How an attacker could exploit the issue

Attackers can reach the vulnerable component without prior authentication, allowing them to access sensitive device information and perform diagnostic actions. This is possible because the websocket handler in the firmware does not correctly check for user authentication before granting access.

Unauthenticated network access required.
Sessionless users trigger vulnerability.
Unauthorized access to device data.

Live Threat

Current exploitation, exposure, and threat context

The websocket handler in the Fanvil x7a firmware, when unauthenticated, could allow unauthorized access to device resources. This may include viewing operational logs or performing diagnostic requests, impacting the confidentiality and integrity of the device's operational data.

Device operational logs and diagnostic data at risk.
Unauthenticated access to websocket handler.
Unauthorized viewing of device data.

Operational Fix

Recommended remediation, mitigation, and detection steps

The discovery of an authentication bypass in Fanvil x7a firmware impacts owners of these devices, who are likely IT infrastructure or operational technology (OT) teams. The initial step is to determine the scope of deployment, identify which devices are network-accessible, and confirm their business criticality to prioritize remediation efforts. This includes locating accountable owners and planning necessary actions, such as firmware updates or network segmentation, based on the assessed risk.

Identify and confirm affected devices.
Verify network reachability and business criticality.
Plan remediation or risk reduction actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Fanvil X7a?

The Fanvil X7a is a professional IP phone designed for enterprise communication. It provides advanced telephony features, such as video support and touchscreen interfaces, typically managed through integrated firmware that handles network services, including web-based administrative and diagnostic functions.

What does CVE-2025-70516 mean in plain English?

This vulnerability is an authentication bypass, specifically categorized as CWE-306 (Missing Authentication for Critical Function). It means the device's websocket handler fails to verify who is connecting. Because the software does not check for credentials, it treats any incoming network connection as authorized, letting unauthorized users interact with restricted diagnostic functions.

How does an attacker trigger this vulnerability?

An attacker triggers the flaw by connecting directly to the device's websocket handler over the network without providing a login session. The vulnerability does not require any prior user interaction or existing account privileges. Conversely, it is not triggered by standard voice traffic or encrypted protocols that bypass the affected websocket interface.

Is my device at risk if it is behind a firewall?

According to Halo Surface Signal, these IP phones are typically deployed within internal networks and are not designed for direct exposure to the public internet. While the device handles network traffic, your primary risk exists if the phone is incorrectly placed on a public-facing gateway, making the vulnerable interface reachable from outside your protected environment.

How should I respond to this advisory?

Start by identifying all deployed Fanvil X7a units within your infrastructure. Once you have a device inventory, verify their network reachability to see if any are exposed beyond internal segments. After assessing the risk, coordinate with your IT team to plan firmware updates or implement network segmentation to isolate these devices until they can be properly patched.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.