CVE-2025-70519

Executive Summary

CVE-2025-70519 is a reflected cross-site scripting (XSS) vulnerability in the device log component of Fanvil x7a VoIP desk phone firmware version 2.6.0.1182. The component fails to sanitize or encode reflected user-supplied data, allowing an attacker to inject HTML that executes malicious JavaScript in the browser of any user who renders the device log interface. Because no patch, vendor fix, or workaround has been published, every deployment of the affected firmware is presumed exposed, and exploitation requires only that a victim view a crafted device log page served by the phone.

Technical Analysis

The vulnerability resides in the device log component of the Fanvil x7a firmware. Per the available description, the component "does not properly sanitize or encode reflected user supplied data," and this "lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log component."

Technically, this is a classic reflected cross-site scripting condition (CWE-79 family). The attack surface is the web-based management/log interface exposed by the phone. Data supplied by the requester — for example a value embedded in a request that is subsequently echoed back into the HTML body of the rendered device log page — is returned to the browser without output encoding. Because the untrusted input is placed into an HTML rendering context unsafely, an attacker can inject markup that the browser will parse and execute as script rather than display as text.

Key characteristics derivable from the description:

• Reflected, not stored: The flaw is explicitly described as affecting "reflected user supplied data." The malicious content is echoed back within the response to the crafted request and is not necessarily persisted on the device. This means delivery typically requires the victim to issue — or be induced to issue — a request that reflects the payload.
• HTML injection as the primitive: The immediate primitive is HTML injection. The escalation path to script execution is the browser rendering that injected HTML. The description states the injected HTML "can be used to execute malicious JavaScript code," which is the standard HTML-injection-to-script-execution chain.
• Script executes in the victim's browser, at the trust context of the device log component: The stated impact is that JavaScript executes "on any target browser which renders the device log component." The origin/trust boundary is the web origin serving the device log page (the phone's management interface).
• Output-context weakness: The defect is one of improper "sanitize or encode" — i.e., missing or inadequate output encoding when user-supplied data is written into the HTML response. No specific parameter name, endpoint path, function name, or class name is present in the source data, so no implementation-level identifiers can be attributed.

No CVSS score, CVSS vector, CWE assignment, affected-version range beyond the single reported firmware build, or OSV package mapping is provided in the source data. No public proof-of-concept, Nuclei template, or exploit code is known.

What cannot be stated from the data: the exact query parameter, form field, or URL path that reflects the payload; the exact HTML tag/attribute context in which the reflection occurs; whether the flaw requires authentication to reach the vulnerable page; and whether the reflection is reachable via GET or POST. These are implementation facts that are absent and must not be invented. The attack chain below is therefore described at the vulnerability-class level and should be confirmed against the live interface during authorized testing.

Exploitation Scenarios

No public PoC is available for CVE-2025-70519; the attack chain below is inferred from the vulnerability class (reflected XSS via HTML injection) and the facts stated in the NVD description. Specific parameter names, endpoints, and request shapes are intentionally omitted because they are not present in the source data.

1) Reconnaissance / target identification. An attacker identifies internet- or LAN-reachable Fanvil x7a devices. These are VoIP desk phones that expose a web management interface; the device log component is reachable through that interface. Shodan-style queries keying on the product string, page title, or response body (as listed in METADATA) can surface exposed devices. In an internal scenario, an attacker with network access — or a malicious insider — enumerates phones on the voice VLAN.

2) Triggering the flaw class. The attacker crafts a request to the device log component in which a user-supplied value contains HTML markup. Because the component reflects this data into the rendered page without sanitization or output encoding (the exact defect described), the injected HTML is returned as part of the response. No specific parameter is named in the source data; in reflected-XSS terms, the attacker locates whichever input within the device log request/response cycle is echoed back into the HTML body.

3) Payload / execution method (class level). The injected HTML is designed to cause the victim's browser to execute JavaScript when it renders the device log page. The canonical mechanism for HTML-injection-to-script is injecting an element or attribute that triggers script execution when parsed/rendered. Delivery to a victim typically takes the form of a crafted link or an induced navigation to the vulnerable device log page, since the flaw is reflected and the victim must render the page for the payload to fire. The victim's browser, not the attacker's, performs the execution.

4) Post-exploitation impact. Because the script executes in the browser's rendering of the device log component, it runs at the trust context of that page's origin — the phone's web interface. The practical consequence is that an attacker can act in the victim's browser session context against the device management interface (for example, performing actions a logged-in administrator could perform, or exfiltrating data rendered on the page). The precise scope depends on the session and privileges of the victim who renders the page, and on the origin/trust boundary of the device log component — details not specified in the source data. The stated, directly supported impact is malicious JavaScript execution in any browser that renders the device log component.

Impact Assessment

Business impact. Fanvil x7a is an enterprise VoIP desk phone. Its web interface is typically used by administrators and, depending on deployment, by end users. A successful reflected XSS against an administrator viewing the device log could allow the attacker to act within the administrator's browser session against the device's management interface. For an enterprise, the tangible risks are unauthorized configuration changes, credential/session abuse within the management interface, and lateral movement opportunities on the voice network — all contingent on who renders the page and what that session can do.

Affected systems / blast radius. The affected scope identified by the data is Fanvil x7a firmware version 2.6.0.1182, specifically the device log component. No broader version range, hardware family, or package mapping is established by the available data, so blast radius beyond this product/build should not be assumed. Organizations should inventory x7a devices running firmware 2.6.0.1182 and treat each as potentially exposed. Exposure is greatest for devices whose web interface is reachable from untrusted networks; internally exposed devices are still reachable by any host on the management/voice VLAN.

CVSS subscores (derived — NVD has not published a score). The source data provides no CVSS score or vector. The derived vector in METADATA (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) reflects the class: network-reachable, low complexity, no privileges required of the attacker, user interaction required (the victim must render the page — consistent with the "reflected" nature), scope changed (script executes in the browser at the device-log origin, crossing from the injected request into the victim's session context), and low confidentiality/integrity impact with no availability impact. This is an analytical estimate for triage only and must not be presented as an official NVD score. No EPSS value exists; FIRST.org has not scored this CVE. CVE is not in CISA KEV, and no exploitation-in-the-wild evidence is present in the source data.

Detection Guidance

Sigma Rule

title: Potential Reflected XSS Probing Against Fanvil X7A Device Log Component
id: 3b9f6c2a-7051-4d1e-9a7c-fanvil70519xss
status: experimental
description: Detects requests to a Fanvil X7A web interface that carry HTML/script
  metacharacters in parameters or the query string, consistent with reflected XSS
  probing against the device log component (CVE-2025-70519).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-70519
author: valtersit.com
date: 2025/01/01
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains:
      - '/log'
      - '/device'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - '%3Cscript'
      - 'onerror='
      - 'onload='
      - '<img'
      - '<svg'
      - 'javascript:'
      - '"><'
  condition: selection_uri and selection_payload
falsepositives:
  - Security scanners and legitimate administrative tooling
  - Web application firewalls logging benign encoded input
level: medium
tags:
  - attack.t1190
  - cve.2025-70519

Note: URI substrings above are generic web-path hints and are not confirmed endpoints from the CVE data; tune to observed paths in your environment.

YARA Rule

rule CVE_2025_70519_Fanvil_X7A_Reflected_XSS
{
    meta:
        description = "Detects reflected HTML/script injection payloads associated with CVE-2025-70519 in Fanvil X7A device log component responses or captured requests"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-70519"
        date = "2025-01-01"
        severity = "medium"

    strings:
        $xss1 = "<script" ascii nocase
        $xss2 = "</script>" ascii nocase
        $xss3 = "onerror=" ascii nocase
        $xss4 = "onload=" ascii nocase
        $xss5 = "javascript:" ascii nocase
        $xss6 = "<svg" ascii nocase
        $xss7 = "<img" ascii nocase
        $fanvil = "Fanvil" ascii nocase
        $x7a = "X7A" ascii nocase
        $logcomp = "device log" ascii nocase

    condition:
        uint16(0) == 0x3C3F or true and
        (2 of ($xss*)) and
        (any of ($fanvil, $x7a, $logcomp))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2025-70519 Fanvil X7A Device Log Reflected XSS Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"log"; nocase; http.uri; content:"<script"; nocase; http.uri; content:"%3Cscript"; nocase; pcre:"/(onerror|onload|javascript:|\<svg|\<img)/iU"; classtype:web-application-attack; reference:cve,2025-70519; reference:url,nvd.nist.gov/vuln/detail/CVE-2025-70519; sid:202570519; rev:1;)

Note: the content:"log" match is a heuristic URI hint, not a confirmed endpoint. Operators should tune the URI match to their observed device-log path and may need to add POST-body inspection via http.request_body once the reflection point is confirmed.

Elastic Detection

network where event.category == "network" and
  process.name != null and
  http.request.method in ("GET", "POST") and
  (
    stringContains(http.request.uri, "log", false) or
    stringContains(http.request.uri, "device", false)
  ) and
  (
    stringContains(http.request.uri, "<script", false) or
    stringContains(http.request.uri, "%3Cscript", false) or
    stringContains(http.request.uri, "onerror=", false) or
    stringContains(http.request.uri, "onload=", false) or
    stringContains(http.request.uri, "javascript:", false) or
    stringContains(http.request.uri, "<svg", false) or
    stringContains(http.request.uri, "<img", false)
  )

Splunk SPL Query

index=web OR index=proxy
| eval uri=coalesce(uri, url, cs_uri_stem, requested_url)
| where match(lower(uri), "(log|device)") AND match(uri, "(?i)(<script|%3Cscript|onerror=|onload=|javascript:|<svg|<img)")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as sample_uris by src_ip, dest_ip, http_user_agent
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,attack,cve-2025-70519,">
  <rule id="2025701" level="8">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">\.*(log|device)\.*</field>
    <regex type="pcre2">(?i)(<script|%3Cscript|onerror=|onload=|javascript:|<svg|<img)</regex>
    <description>CVE-2025-70519: Possible reflected XSS attempt against Fanvil X7A device log component (suspicious input in URL)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_scan,pci_dss_6.5.7,</group>
  </rule>
</group>

Note: the URL path match is a generic heuristic and should be adjusted to the actual device-log path once identified. Referencing CVE IDs requires a matching <rule id=...> entry loaded in local_rules.xml; adjust the rule ID to avoid collision with existing local rules.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations.

• Isolate the affected device's web management interface from untrusted and general-access networks. Restrict reachability to a dedicated, access-controlled management VLAN.
• Do not browse to the device log component from a browser session that also uses privileged/administrator credentials against untrusted links. Assume any reflected input into that page may execute script.
• Enforce strict access control on the web interface and disable it where management via the web UI is not operationally required (if the platform allows).
• Deploy the network/IDS/WAF signatures above to detect probing of the device log component (recognizing the endpoint paths are unconfirmed and must be tuned).
• Treat the device log page as untrusted content; open it only in a hardened/managed browser session isolated from sensitive credentials.

2) Patch / upgrade steps.

• No vendor patch, fixed firmware version, advisory, or workaround is identified in any tracked source. There is no confirmed remediation build to upgrade to.
• Contact Fanvil support / the authorized reseller to request a firmware fix and a security advisory for the device log component. Until a fix is published, upgrading is not a viable path, and affected devices must be treated as unpatched.
• Monitor Fanvil's advisory channels and the NVD entry for CVE-2025-70519 for a fixed firmware release; apply it immediately when available.

3) Long-term hardening.

• Establish a firmware lifecycle program for VoIP endpoints: inventory, version tracking, and prompt patching once vendor fixes ship.
• Segment voice infrastructure from data networks; apply least-privilege access to administrative interfaces; require strong unique credentials.
• Adopt a mature browser security posture (CSP where controllable, sandboxing) and restrict administrative access to phone web UIs to jump hosts.
• Include reflected-XSS output-encoding review in vendor assessments for edge/VoIP devices; preserve logs of access to the device log component for retrospective hunting.

References

• NVD — CVE-2025-70519: https://nvd.nist.gov/vuln/detail/CVE-2025-70519
• CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• MITRE ATT&CK T1059.007 — Command and Scripting Interpreter: JavaScript (relevant to browser-based script execution): https://attack.mitre.org/techniques/T1059/007/
• Fanvil vendor site (monitor for a security advisory / fixed firmware for x7a): https://www.fanvil.com/

Threat actor campaigns / exploit-in-the-wild: none identified in the source data. CVE-2025-70519 is not listed in CISA KEV, no public PoC or Nuclei template exists, and no FIRST.org EPSS score has been assigned.