CVE-2025-64055
📋 TL;DR
CVE-2025-64055 is an authentication bypass vulnerability in Fanvil x210 V2 IP phones that allows unauthenticated attackers on the local network to access administrative functions. This affects organizations using these devices, particularly those with the phones exposed to untrusted networks. Attackers can perform actions like firmware uploads, file manipulation, and device reboots without credentials.
💻 Affected Systems
- Fanvil x210 V2
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing firmware replacement with malicious code, persistent backdoor installation, credential theft, and use as a pivot point into the network.
Likely Case
Unauthorized administrative access leading to device disruption, configuration changes, call interception, and potential data exfiltration.
If Mitigated
Limited impact if devices are properly segmented and network access controls prevent unauthorized local network access.
🎯 Exploit Status
Exploit details are publicly available in the GitHub advisory. The vulnerability requires crafting specific requests to bypass authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://fanvil.com
Restart Required: No
Instructions:
1. Check Fanvil website for firmware updates. 2. Download latest firmware if available. 3. Upload via web interface. 4. Apply update. 5. Verify version after update.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Fanvil phones on separate VLAN with strict access controls
Disable Web Interface
allTurn off web administration interface if not required
🧯 If You Can't Patch
- Implement strict network access controls to limit which devices can communicate with the phones
- Monitor network traffic to/from Fanvil devices for suspicious administrative requests
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface at http://[device-ip] or via phone menu System > Status > VersionCheck Version:
curl -s http://[device-ip]/cgi-bin/getSystemInfo.cgi | grep FirmwareVerify Fix Applied:
Verify firmware version is newer than 2.12.20 and test authentication bypass attempts fail📡 Detection & Monitoring
Log Indicators:
- Unauthenticated access to administrative endpoints
- Multiple failed login attempts followed by successful administrative actions
Network Indicators:
- Unusual HTTP POST requests to administrative endpoints from unauthorized IPs
- Traffic to firmware upload endpoints without preceding authentication
SIEM Query:
source="fanvil_web_logs" AND (uri="/cgi-bin/updateFirmware.cgi" OR uri="/cgi-bin/uploadFile.cgi") AND NOT (user!="")