CVE-2025-64055

CRITICAL

Fanvil x210 V2 2.12.20 - Unauthenticated Authentication Bypass

Title source: llm

Description

An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to access administrative functions of the device (e.g. file upload, firmware update, reboot...) via a crafted authentication bypass.

References (2)

Core 2

Core References

Product

http://fanvil.com

Exploit, Third Party Advisory

https://github.com/SpikeReply/advisories/blob/main/cve/fanvil/cve-2025-64055.md

View Exploit ZIP pw:eip

Scores

CVSS v3 9.8

EPSS 0.0051

EPSS Percentile 39.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-287

Status published

Products (1)

fanvil/x210_firmware 2.12.20

Published Dec 03, 2025

Tracked Since Feb 18, 2026