# CVE-2025-64052: Fanvil x210 V2 command injection in web configuration interface

Source: https://junglewise.ai/threats/cve-2025-64052-fanvil-x210-v2-command-injection-in-web-configuration-interface  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-05. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-64052 · Severity: medium · CVSS 5.1 · Published 2025-12-05

Fanvil x210 V2 is an enterprise-grade IP phone used for business communications. A security flaw in its web-based configuration interface allows an attacker on the same local network to take control of the device by executing unauthorized system commands. This could lead to eavesdropping, service disruption, or using the phone as a foothold to attack other parts of the corporate network.

Technologies: [Fanvil X210](https://junglewise.ai/threats/technologies/x210), [Fanvil X210 V2](https://junglewise.ai/threats/technologies/x210-v2), [Fanvil X210 Firmware](https://junglewise.ai/threats/technologies/x210-firmware). Vendors: [Fanvil](https://junglewise.ai/threats/vendors/fanvil).

## Quick answers

**Is CVE-2025-64052 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-64052 being exploited in the wild.

**How severe is CVE-2025-64052?** Medium severity, with a CVSS score of 5.1, published 5 December 2025.

**Which products and versions are affected?** Fanvil X210 V2 2.12.20.

**Is there a fix for CVE-2025-64052?** A patch was published on 2025-04-28: Vendor released firmware v2.12.22.2 which addresses the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-64052 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2025-64052?** Check whether you run Fanvil X210, Fanvil X210 V2 or Fanvil X210 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Multiple command injection vulnerabilities exist in the web configuration interface of Fanvil x210 V2 (firmware 2.12.20). The flaws are located within the file upload functionality at /cgi-bin/webconfig, specifically affecting the 'upload/dest' and 'upload/newfile' parameters. An unauthenticated attacker on the local network can exploit these by sending a specially crafted multipart POST request containing shell metacharacters. The vulnerability stems from improper neutralization of special elements used in a command (CWE-77). Successful exploitation allows for arbitrary code execution with the privileges of the web server. The issue is reportedly addressed in firmware version 2.12.22.2.

## Affected products

- Fanvil x210 V2 2.12.20

## Timeline

- 2025-03-01: disclosed: Vulnerability discovered by Spike Reply Cybersecurity Team
- 2025-03-04: other: Initial contact with vendor
- 2025-04-28: patched: Vendor released firmware v2.12.22.2 which addresses the issue
- 2025-12-05: advisory: Public disclosure and CVE assignment

## References

- [https://github.com/SpikeReply/advisories/blob/main/cve/fanvil/cve-2025-64052.md](https://github.com/SpikeReply/advisories/blob/main/cve/fanvil/cve-2025-64052.md)

## Related threats

- [Fanvil x210 V2 unauthenticated arbitrary file upload in webconfig](https://junglewise.ai/threats/cve-2025-64056-fanvil-x210-v2-unauthenticated-arbitrary-file-upload-in-webconfig)
- [Fanvil x210 reflected XSS in upload page](https://junglewise.ai/threats/cve-2025-64054-fanvil-x210-reflected-xss-in-upload-page)
- [Fanvil x210 buffer overflow in webconfig upload](https://junglewise.ai/threats/cve-2025-64053-fanvil-x210-buffer-overflow-in-webconfig-upload)
- [Fanvil x210 V2 directory traversal and RCE in web interface](https://junglewise.ai/threats/cve-2025-64057-fanvil-x210-v2-directory-traversal-and-rce-in-web-interface)
- [Fanvil x210 V2 authentication bypass in httpd cgi-bin](https://junglewise.ai/threats/cve-2025-64055-fanvil-x210-v2-authentication-bypass-in-httpd-cgi-bin)