CVE-2025-64055 | An issue was discovered in Fanvil x210 V2 2.12.20 allowing u… | CVSS 9.8 CRITICAL

Description

An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to access administrative functions of the device (e.g. file upload, firmware update, reboot...) via a crafted authentication bypass.

Metadata

CVE ID: CVE-2025-64055
State: PUBLISHED
Assigner: mitre
Reserved: 2025-10-27 00:00 UTC
Published: 2025-12-03 00:00 UTC
Last updated: 2026-07-05 01:22 UTC
Primary CWE: CWE-287
CWE-287 Improper Authentication
Vendor / Product: n/a / n/a
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
n/a	n/a	—	n/a

Weakness (CWE)

CWE	Source	Description
—	cna	n/a
CWE-287	adp	CWE-287 Improper Authentication

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	adp	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (1)

https://github.com/SpikeReply/advisories/blob/main/cve/fanvil/cve-2025-64055.md