CVE-2025-64055

An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to access administrative functions of the device (e.g. file upload, firmware update, reboot...) via a crafted authentication bypass.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/SpikeReply/advisories/blob/main/cve/fanvil/cve-2025-64055.md	Exploit Third Party Advisory
https://github.com/SpikeReply/advisories/blob/main/cve/fanvil/cve-2025-64055.md	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:fanvil:x210_firmware:2.12.20:*:*:*:*:*:*:*

cpe:2.3:h:fanvil:x210:2.0:*:*:*:*:*:*:*

History

25 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Se descubrió un problema en Fanvil x210 V2 2.12.20 que permite a atacantes no autenticados en la red local acceder a funciones administrativas del dispositivo (por ejemplo, carga de archivos, actualización de firmware, reinicio...) mediante una elaborada omisión de autenticación.

Information

Published : 2025-12-03 21:15

Updated : 2026-09-25 23:10

NVD link : CVE-2025-64055

Mitre link : CVE-2025-64055

CVE.ORG link : CVE-2025-64055

JSON object : View

Products Affected

fanvil

x210_firmware
x210

CWE

CWE-287

Improper Authentication

{"id": "CVE-2025-64055", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64055", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-05T20:07:32.421477Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-12-03T21:15:52.813", "references": [{"url": "https://github.com/SpikeReply/advisories/blob/main/cve/fanvil/cve-2025-64055.md", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/SpikeReply/advisories/blob/main/cve/fanvil/cve-2025-64055.md", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to access administrative functions of the device (e.g. file upload, firmware update, reboot...) via a crafted authentication bypass."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en Fanvil x210 V2 2.12.20 que permite a atacantes no autenticados en la red local acceder a funciones administrativas del dispositivo (por ejemplo, carga de archivos, actualizaci\u00f3n de firmware, reinicio...) mediante una elaborada omisi\u00f3n de autenticaci\u00f3n."}], "lastModified": "2026-09-25T23:10:00.463", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fanvil:x210_firmware:2.12.20:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B5339CEB-DD13-43D9-9DBB-F58EA2EDC47D"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:fanvil:x210:2.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "826351F9-626E-4EA9-9634-9E04B462AF4A"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}