CVE-2025-70517
The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the applicat…
Published: 2026-10-07 · CVSS: 8.8 · CVSS 3.1
The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the applications. Due to the lack of protection, cross-origin boundary can be completely bypassed, allowing for Cross-Site Request Forgery Attacks against any endpoint.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7