CVE-2025-64054
Published: 05 December 2025
Description
A reflected Cross Site Scripting (XSS) vulnerability on Fanvil x210 2.12.20 devices allows attackers to cause a denial of service or potentially execute arbitrary commands via crafted POST request to the /cgi-bin/webconfig?page=upload&action=submit endpoint.
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of POST request inputs at the vulnerable /cgi-bin/webconfig endpoint to block malicious XSS payloads before processing.
Mandates filtering of reflected outputs from the upload endpoint to prevent injected scripts from executing in the victim's browser.
Ensures timely identification, reporting, and patching of the specific XSS flaw in Fanvil x210 firmware version 2.12.20.
Security SummaryAI
CVE-2025-64054 is a reflected Cross-Site Scripting (XSS) vulnerability affecting Fanvil x210 devices running firmware version 2.12.20. The flaw exists in the /cgi-bin/webconfig?page=upload&action=submit endpoint, where a crafted POST request can inject malicious scripts. It is classified under CWE-79 and carries a CVSS v3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low complexity, and potential for high-impact consequences across confidentiality, integrity, and availability.
Unauthenticated attackers on the network can exploit this vulnerability by tricking users into interacting with a maliciously crafted POST request, such as via a phishing link or social engineering. Successful exploitation leads to reflected XSS, enabling denial of service on the targeted device or, in some cases, potential execution of arbitrary commands within the victim's browser context, leveraging the changed scope for broader impact.
Mitigation details and advisories are available from the vendor at http://fanvil.com and in the SpikeReply advisory at https://github.com/SpikeReply/advisories/blob/main/cve/fanvil/cve-2025-64054.md, published on 2025-12-05. Security practitioners should consult these resources for patching instructions or workarounds specific to Fanvil x210 firmware updates.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS vulnerability in a public-facing web endpoint (/cgi-bin/webconfig) on Fanvil x210 network device enables unauthenticated exploitation of public-facing applications.