Is CVE-2025-64053 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-64053 being exploited in the wild.

How severe is CVE-2025-64053?

High severity, with a CVSS score of 7.5, published 5 December 2025.

Is there a fix for CVE-2025-64053?

A patch was published on 2025-04-28: Firmware version 2.12.22.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-64053 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-64053?

Check whether you run Fanvil X210, Fanvil X210 V2 or Fanvil X210 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-64053: Fanvil x210 buffer overflow in webconfig upload

CVE-2025-64053 · Severity: high · CVSS 7.5 · Published 2025-12-05

A security vulnerability has been identified in Fanvil x210 enterprise IP phones, which are commonly used for business communications. An attacker can exploit this flaw to crash the device, causing a denial of service, or potentially gain unauthorized control over the phone. This could disrupt business operations and compromise the security of the communication endpoint.

Technologies: Fanvil X210, Fanvil X210 V2, Fanvil X210 Firmware. Vendors: Fanvil.

Quick answers

Is CVE-2025-64053 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-64053 being exploited in the wild.
How severe is CVE-2025-64053?: High severity, with a CVSS score of 7.5, published 5 December 2025.
Which products and versions are affected?: Fanvil X210 V2 2.12.20.
Is there a fix for CVE-2025-64053?: A patch was published on 2025-04-28: Firmware version 2.12.22.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-64053 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-64053?: Check whether you run Fanvil X210, Fanvil X210 V2 or Fanvil X210 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A classic buffer overflow (CWE-120) exists in the CGI script handling the '/cgi-bin/webconfig?page=upload&action=submit' endpoint on Fanvil x210 V2 devices running firmware 2.12.20. The vulnerability is triggered because the application fails to validate the length of the 'upload/dest' POST parameter. An attacker can provide a payload exceeding 704 characters to overflow the buffer, leading to a denial of service (DoS) or potential remote code execution (RCE). The issue is addressed in firmware version 2.12.22.2.

Affected products

Fanvil x210 V2 2.12.20

Timeline

2025-03-01: disclosed: Vulnerability discovered by Spike Reply Cybersecurity Team
2025-03-04: other: Initial contact with vendor
2025-04-28: patched: Firmware version 2.12.22.2 released
2025-12-05: advisory: Public disclosure and CVE assignment

References

https://github.com/SpikeReply/advisories/blob/main/cve/fanvil/cve-2025-64053.md

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.