CVE-2025-64057

Directory traversal vulnerability in Fanvil x210 V2 2.12.20 allows unauthenticated attackers on the local network to store files in arbitrary locations and potentially modify the system configuration or other unspecified impacts.

CVSS v3 8.3 HIGH

8.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.5

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/SpikeReply/advisories/blob/main/cve/fanvil/cve-2025-64057.md	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:fanvil:x210_firmware:2.12.20:*:*:*:*:*:*:*

cpe:2.3:h:fanvil:x210:2.0:*:*:*:*:*:*:*

History

25 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de salto de directorio en Fanvil x210 V2 2.12.20 permite a atacantes no autenticados en la red local almacenar archivos en ubicaciones arbitrarias y potencialmente modificar la configuración del sistema u otros impactos no especificados.

Information

Published : 2025-12-05 15:15

Updated : 2026-09-25 23:10

NVD link : CVE-2025-64057

Mitre link : CVE-2025-64057

CVE.ORG link : CVE-2025-64057

JSON object : View

Products Affected

fanvil

x210_firmware
x210

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2025-64057", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64057", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-05T15:19:34.292348Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 5.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-12-05T15:15:51.860", "references": [{"url": "https://github.com/SpikeReply/advisories/blob/main/cve/fanvil/cve-2025-64057.md", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in Fanvil x210 V2 2.12.20 allows unauthenticated attackers on the local network to store files in arbitrary locations and potentially modify the system configuration or other unspecified impacts."}, {"lang": "es", "value": "Vulnerabilidad de salto de directorio en Fanvil x210 V2 2.12.20 permite a atacantes no autenticados en la red local almacenar archivos en ubicaciones arbitrarias y potencialmente modificar la configuraci\u00f3n del sistema u otros impactos no especificados."}], "lastModified": "2026-09-25T23:10:00.463", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fanvil:x210_firmware:2.12.20:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B5339CEB-DD13-43D9-9DBB-F58EA2EDC47D"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:fanvil:x210:2.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "826351F9-626E-4EA9-9634-9E04B462AF4A"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}