External risk intelligence

Fanvil X7A Firmware Authentication Bypass Allows Resource Access.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-70520

The vulnerability affects the websocket handler of a Fanvil X7A, which is an enterprise IP phone. Such devices are frequently deployed in environments where their management or operational interfaces may be exposed to the network, and the lack of authentication allows unauthorized access to device resources, consistent with common internet-accessible management or edge-reachable services.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the websocket handler of Fanvil X7A devices, allowing unauthorized access to operational logs and diagnostic functions due to a lack of proper authentication. This could potentially expose sensitive device information and allow for manipulation of device operations. The main concern at this time is confirming relevance and exposure within our environment.

Unrestricted access to device logs and functions.
Potential for unauthorized access to device resources.
Confirm relevance and exposure in our environment.

Attack Path

How an attacker could exploit the issue

An attacker could target a Fanvil X7A phone by sending requests to its websocket handler. This component's failure to properly check for user authentication allows unauthorized access to sensitive device information and diagnostic functions. The vulnerability could lead to a compromise of device resources if an attacker can reach and interact with the vulnerable component.

No authentication required for access.
Triggered via websocket requests.
Unauthorized access to device resources.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated users to access sensitive device resources and perform diagnostic requests on Fanvil x7a devices. The lack of authentication on the websocket handler means that anyone with network access to the device could potentially view operational logs or initiate diagnostic functions.

Device operational logs and diagnostic functions at risk.
Exposure via unauthenticated network access.
Unauthorized access to device information.

Operational Fix

Recommended remediation, mitigation, and detection steps

The affected technology is Fanvil X7A IP phones, which are typically managed by IT infrastructure or device management teams. The first step should be to identify all deployed Fanvil X7A devices, confirm their network exposure and business criticality, and identify the accountable owner for each device. Remediation planning should then proceed based on this risk assessment.

Identify and locate affected devices.
Verify network exposure and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Fanvil X7A and what is it used for?

The Fanvil X7A is an enterprise-grade IP phone designed for professional communication environments. It integrates advanced telephony features with a touchscreen interface, often utilized in business settings to manage calls and internal office communications via network-connected infrastructure.

What does CVE-2025-70520 mean for device security?

This vulnerability is classified as Missing Authentication for Critical Function (CWE-306). It means the device's websocket handler fails to verify the identity of anyone connecting to it, allowing unauthorized users to interact with sensitive diagnostic tools or read logs without providing credentials.

How is this vulnerability triggered?

An attacker triggers the flaw by sending crafted websocket requests directly to the affected service on the device. Simply browsing the device's normal user-facing interface or standard phone menus does not trigger the vulnerability; it requires specific, unauthorized interaction with the underlying websocket handler.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal identifies this as a likely risk because these enterprise phones are often deployed in configurations where their management interfaces are accessible over the network. If your device is reachable from the broader corporate network or the internet rather than being strictly isolated, it is more susceptible to these unauthenticated requests.

Do I need to take action if I manage these phones?

Yes, start by inventorying your deployment to locate all Fanvil X7A units. Determine which devices are reachable over your network and assess their business criticality. Once identified, work with your device management team to restrict network access to these interfaces while monitoring for official firmware updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.