What is GHSA-rv2w-876m-ggq4?

GHSA-rv2w-876m-ggq4 is a security advisory published by GitHub Security Advisories with Critical severity. The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not...

Which CVE IDs does GHSA-rv2w-876m-ggq4 cover?

GHSA-rv2w-876m-ggq4 covers the following CVE IDs: CVE-2025-70521. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rv2w-876m-ggq4?

GHSA-rv2w-876m-ggq4 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-rv2w-876m-ggq4CriticalCVSS 9.8

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not...

Vendor

GitHub Security Advisories

Published

October 7, 2026

Last Modified

October 7, 2026

🔗 CVE IDs covered (1)

CVE-2025-70521 →

📋 Description

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-70521
https://www.darkpoint.ca/blog/2026/02/27/Fanvil-x7a-PA2S-Vulnerability-Disclosure
https://www.fanvil.com/products/p5/wulianwangwangguan_1/20210921/5035.html
http://download.fanvil.com/Firmware/Release/PA2S
https://github.com/advisories/GHSA-rv2w-876m-ggq4