Quick answers
- Is CVE-2025-64054 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-64054 being exploited in the wild.
- How severe is CVE-2025-64054?
- Critical severity, with a CVSS score of 9.6, published 5 December 2025.
- Which products and versions are affected?
- Fanvil X210 V2 2.12.20.
- Is there a fix for CVE-2025-64054?
- A patch was published on 2025-04-28: Firmware version 2.12.22.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-64054 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2025-64054?
- Check whether you run Fanvil X210, Fanvil X210 V2 or Fanvil X210 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A reflected Cross-Site Scripting (XSS) vulnerability exists in the web management interface of Fanvil x210 V2 devices running firmware version 2.12.20. The vulnerability is located in the /cgi-bin/webconfig?page=upload&action=submit endpoint, where the 'filename' POST parameter is improperly neutralized before being reflected in the response. While standard <script> tags are blocked by CGI path separators, attackers can bypass this using event handlers (e.g., <img src=x onerror=...>) to execute arbitrary JavaScript in the context of the user's session. This can be leveraged to perform administrative actions, cause a denial of service, or potentially execute system commands. The issue is reportedly fixed in firmware version 2.12.22.2.
Affected products
- Fanvil x210 V2 2.12.20
Timeline
- 2025-03-01: other: Vulnerability discovered
- 2025-03-04: other: Initial contact with vendor
- 2025-04-28: patched: Firmware version 2.12.22.2 released
- 2025-12-05: advisory: CVE published