# CVE-2025-64053: Fanvil x210 buffer overflow in webconfig upload

Source: https://junglewise.ai/threats/cve-2025-64053-fanvil-x210-buffer-overflow-in-webconfig-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-05. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-64053 · Severity: high · CVSS 7.5 · Published 2025-12-05

A security vulnerability has been identified in Fanvil x210 enterprise IP phones, which are commonly used for business communications. An attacker can exploit this flaw to crash the device, causing a denial of service, or potentially gain unauthorized control over the phone. This could disrupt business operations and compromise the security of the communication endpoint.

Technologies: [Fanvil X210](https://junglewise.ai/threats/technologies/x210), [Fanvil X210 V2](https://junglewise.ai/threats/technologies/x210-v2), [Fanvil X210 Firmware](https://junglewise.ai/threats/technologies/x210-firmware). Vendors: [Fanvil](https://junglewise.ai/threats/vendors/fanvil).

## Quick answers

**Is CVE-2025-64053 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-64053 being exploited in the wild.

**How severe is CVE-2025-64053?** High severity, with a CVSS score of 7.5, published 5 December 2025.

**Which products and versions are affected?** Fanvil X210 V2 2.12.20.

**Is there a fix for CVE-2025-64053?** A patch was published on 2025-04-28: Firmware version 2.12.22.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-64053 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-64053?** Check whether you run Fanvil X210, Fanvil X210 V2 or Fanvil X210 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A classic buffer overflow (CWE-120) exists in the CGI script handling the '/cgi-bin/webconfig?page=upload&action=submit' endpoint on Fanvil x210 V2 devices running firmware 2.12.20. The vulnerability is triggered because the application fails to validate the length of the 'upload/dest' POST parameter. An attacker can provide a payload exceeding 704 characters to overflow the buffer, leading to a denial of service (DoS) or potential remote code execution (RCE). The issue is addressed in firmware version 2.12.22.2.

## Affected products

- Fanvil x210 V2 2.12.20

## Timeline

- 2025-03-01: disclosed: Vulnerability discovered by Spike Reply Cybersecurity Team
- 2025-03-04: other: Initial contact with vendor
- 2025-04-28: patched: Firmware version 2.12.22.2 released
- 2025-12-05: advisory: Public disclosure and CVE assignment

## References

- [https://github.com/SpikeReply/advisories/blob/main/cve/fanvil/cve-2025-64053.md](https://github.com/SpikeReply/advisories/blob/main/cve/fanvil/cve-2025-64053.md)

## Related threats

- [Fanvil x210 V2 unauthenticated arbitrary file upload in webconfig](https://junglewise.ai/threats/cve-2025-64056-fanvil-x210-v2-unauthenticated-arbitrary-file-upload-in-webconfig)
- [Fanvil x210 reflected XSS in upload page](https://junglewise.ai/threats/cve-2025-64054-fanvil-x210-reflected-xss-in-upload-page)
- [Fanvil x210 V2 command injection in web configuration interface](https://junglewise.ai/threats/cve-2025-64052-fanvil-x210-v2-command-injection-in-web-configuration-interface)
- [Fanvil x210 V2 directory traversal and RCE in web interface](https://junglewise.ai/threats/cve-2025-64057-fanvil-x210-v2-directory-traversal-and-rce-in-web-interface)
- [Fanvil x210 V2 authentication bypass in httpd cgi-bin](https://junglewise.ai/threats/cve-2025-64055-fanvil-x210-v2-authentication-bypass-in-httpd-cgi-bin)