What is GHSA-24vj-wxqq-2fxq?

GHSA-24vj-wxqq-2fxq is a security advisory published by GitHub Security Advisories with Critical severity. The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not...

Which CVE IDs does GHSA-24vj-wxqq-2fxq cover?

GHSA-24vj-wxqq-2fxq covers the following CVE IDs: CVE-2025-70518. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-24vj-wxqq-2fxq?

GHSA-24vj-wxqq-2fxq has a CVSS v3 base score of 10.0, published by GitHub Security Advisories.

GHSA-24vj-wxqq-2fxqCriticalCVSS 10.0

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not...

Vendor

GitHub Security Advisories

Published

October 7, 2026

Last Modified

October 7, 2026

🔗 CVE IDs covered (1)

CVE-2025-70518 →

📋 Description

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-70518
https://www.darkpoint.ca/blog/2026/02/27/Fanvil-x7a-PA2S-Vulnerability-Disclosure
https://www.fanvil.com/products/p1/x/20210921/5043.html
http://download.fanvil.com/Firmware/Release/X7A
https://github.com/advisories/GHSA-24vj-wxqq-2fxq