# CVE-2025-64054: Fanvil x210 reflected XSS in upload page

Source: https://junglewise.ai/threats/cve-2025-64054-fanvil-x210-reflected-xss-in-upload-page  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-05. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-64054 · Severity: critical · CVSS 9.6 · Published 2025-12-05

A security vulnerability exists in the Fanvil x210 enterprise IP phone, which is used for business communications. An attacker can trick a user into clicking a malicious link or submitting a specially crafted request, allowing the attacker to run unauthorized commands on the device. This could lead to a complete takeover of the phone, disruption of service, or unauthorized access to communication data.

Technologies: [Fanvil X210](https://junglewise.ai/threats/technologies/x210), [Fanvil X210 V2](https://junglewise.ai/threats/technologies/x210-v2), [Fanvil X210 Firmware](https://junglewise.ai/threats/technologies/x210-firmware). Vendors: [Fanvil](https://junglewise.ai/threats/vendors/fanvil).

## Quick answers

**Is CVE-2025-64054 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-64054 being exploited in the wild.

**How severe is CVE-2025-64054?** Critical severity, with a CVSS score of 9.6, published 5 December 2025.

**Which products and versions are affected?** Fanvil X210 V2 2.12.20.

**Is there a fix for CVE-2025-64054?** A patch was published on 2025-04-28: Firmware version 2.12.22.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-64054 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-64054?** Check whether you run Fanvil X210, Fanvil X210 V2 or Fanvil X210 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A reflected Cross-Site Scripting (XSS) vulnerability exists in the web management interface of Fanvil x210 V2 devices running firmware version 2.12.20. The vulnerability is located in the /cgi-bin/webconfig?page=upload&action=submit endpoint, where the 'filename' POST parameter is improperly neutralized before being reflected in the response. While standard <script> tags are blocked by CGI path separators, attackers can bypass this using event handlers (e.g., <img src=x onerror=...>) to execute arbitrary JavaScript in the context of the user's session. This can be leveraged to perform administrative actions, cause a denial of service, or potentially execute system commands. The issue is reportedly fixed in firmware version 2.12.22.2.

## Affected products

- Fanvil x210 V2 2.12.20

## Timeline

- 2025-03-01: other: Vulnerability discovered
- 2025-03-04: other: Initial contact with vendor
- 2025-04-28: patched: Firmware version 2.12.22.2 released
- 2025-12-05: advisory: CVE published

## References

- [https://github.com/SpikeReply/advisories/blob/main/cve/fanvil/cve-2025-64054.md](https://github.com/SpikeReply/advisories/blob/main/cve/fanvil/cve-2025-64054.md)

## Related threats

- [Fanvil x210 V2 unauthenticated arbitrary file upload in webconfig](https://junglewise.ai/threats/cve-2025-64056-fanvil-x210-v2-unauthenticated-arbitrary-file-upload-in-webconfig)
- [Fanvil x210 buffer overflow in webconfig upload](https://junglewise.ai/threats/cve-2025-64053-fanvil-x210-buffer-overflow-in-webconfig-upload)
- [Fanvil x210 V2 command injection in web configuration interface](https://junglewise.ai/threats/cve-2025-64052-fanvil-x210-v2-command-injection-in-web-configuration-interface)
- [Fanvil x210 V2 directory traversal and RCE in web interface](https://junglewise.ai/threats/cve-2025-64057-fanvil-x210-v2-directory-traversal-and-rce-in-web-interface)
- [Fanvil x210 V2 authentication bypass in httpd cgi-bin](https://junglewise.ai/threats/cve-2025-64055-fanvil-x210-v2-authentication-bypass-in-httpd-cgi-bin)