Is CVE-2025-64057 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-64057 being exploited in the wild.

How severe is CVE-2025-64057?

High severity, with a CVSS score of 8.3, published 5 December 2025.

Is there a fix for CVE-2025-64057?

A patch was published on 2025-04-28: Firmware version 2.12.22.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-64057 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2025-64057?

Check whether you run Fanvil X210, Fanvil X210 V2 or Fanvil X210 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-64057: Fanvil x210 V2 directory traversal and RCE in web interface

CVE-2025-64057 · Severity: high · CVSS 8.3 · Published 2025-12-05

A security vulnerability in Fanvil x210 V2 enterprise IP phones allows unauthorized individuals on the same local network to take full control of the device. By exploiting a flaw in how the phone handles file uploads, an attacker can modify system settings or execute malicious commands. This could lead to eavesdropping on calls, service disruption, or using the phone as a foothold to attack other parts of the corporate network.

Technologies: Fanvil X210, Fanvil X210 V2, Fanvil X210 Firmware. Vendors: Fanvil.

Quick answers

Is CVE-2025-64057 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-64057 being exploited in the wild.
How severe is CVE-2025-64057?: High severity, with a CVSS score of 8.3, published 5 December 2025.
Which products and versions are affected?: Fanvil X210 V2 2.12.20.
Is there a fix for CVE-2025-64057?: A patch was published on 2025-04-28: Firmware version 2.12.22.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-64057 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2025-64057?: Check whether you run Fanvil X210, Fanvil X210 V2 or Fanvil X210 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A directory traversal vulnerability exists in the web configuration interface of Fanvil x210 V2 devices running firmware version 2.12.20. The flaw resides in the file upload functionality, which fails to validate file extensions and improperly handles destination paths. An unauthenticated attacker on the adjacent network can upload a malicious shell script, which the system automatically grants execution permissions to before moving it to a user-specified directory. By placing the script in the /webroot/cgi-bin directory, the attacker can trigger its execution via the CGI processor, resulting in full remote command execution (RCE) with system privileges. The issue is reportedly addressed in firmware version 2.12.22.2.

Affected products

Fanvil x210 V2 2.12.20

Timeline

2025-03-01: disclosed: Vulnerability discovered by Spike Reply Cybersecurity Team
2025-03-04: other: Initial contact with vendor
2025-04-28: patched: Firmware version 2.12.22.2 released
2025-12-05: advisory: NVD publication date

References

https://github.com/SpikeReply/advisories/blob/main/cve/fanvil/cve-2025-64057.md

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.