CVE-2025-70521

Description

A flaw was found in the Fanvil x7a diagnostic ping tool. The device management portal fails to properly validate user-supplied input. An unauthenticated remote attacker can exploit this issue to execute arbitrary commands and run malicious code within the underlying operating system.

Statement

A CRITICAL severity OS command injection flaw exists in the Fanvil x7a Android-based IP phone. The management portal's diagnostic ping tool does not securely handle user-supplied input, which allows an unauthenticated remote attacker to inject and execute arbitrary shell commands on the device's underlying Android operating system via a specially crafted websocket request, fully compromising the confidentiality, integrity, and availability of the affected device. The upstream disclosure also lists the Fanvil PA2S SIP gateway as affected. This flaw is limited to third-party Fanvil hardware and firmware: no Red Hat products are affected, because Red Hat does not ship or maintain the vulnerable Fanvil firmware, and the underlying Android operating system is only the execution environment rather than the vulnerable component. The Red Hat severity (CRITICAL, CVSS 9.8) is consistent with the CISA assessment.

Mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Understanding the Weakness (CWE)

CWE-78

Confidentiality,Integrity,Availability,Non-Repudiation

Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities

Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.