CVE-2025-64056

MEDIUM

Fanvil X210 Firmware - Missing Authentication

Title source: rule

File upload vulnerability in Fanvil x210 V2 2.12.20 allows unauthenticated attackers on the local network to store arbitrary files on the filesystem.

Core 2

Core References

Product

Exploit, Third Party Advisory

CVSS v3 4.3

EPSS 0.0005

EPSS Percentile 15.1%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

CWE

CWE-306

Status published

Products (1)

fanvil/x210_firmware 2.12.20

Published Dec 05, 2025

Tracked Since Feb 18, 2026