Is CVE-2025-70522 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-70522 being exploited in the wild.

How severe is CVE-2025-70522?

High severity, with a CVSS score of 8.8, published 7 October 2026.

Is there a fix for CVE-2025-70522?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-70522 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-70522?

Check whether you run Fanvil X7a at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-70522: Fanvil x7a cross-site request forgery in request handler

CVE-2025-70522 · Severity: high · CVSS 8.8 · Published 2026-10-07

Fanvil x7a is an Android-based VoIP telephone that allows enterprises to make calls and manage communications. The device's web request handler lacks cross-origin protection, allowing attackers to trick authenticated users into performing unwanted actions on the phone—such as changing settings, making calls, or accessing sensitive information—through malicious websites.

Technologies: Fanvil X7a. Vendors: Fanvil.

Quick answers

Is CVE-2025-70522 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-70522 being exploited in the wild.
How severe is CVE-2025-70522?: High severity, with a CVSS score of 8.8, published 7 October 2026.
Which products and versions are affected?: Fanvil X7a 2.6.0.1182.
Is there a fix for CVE-2025-70522?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-70522 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-70522?: Check whether you run Fanvil X7a at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The request handler in Fanvil x7a firmware 2.6.0.1182 fails to enforce CSRF protections on state-changing requests, allowing cross-origin attacks. An unauthenticated remote attacker can craft malicious requests that, when loaded by a user with an active session to the device, modify device configuration or perform administrative actions without explicit user consent. No authentication bypass is required if the user is already authenticated to the device.

Affected products

Fanvil x7a 2.6.0.1182

Timeline

2026-02-27: disclosed
2026-10-07: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.