CVE-2025-64056
📋 TL;DR
An unauthenticated file upload vulnerability in Fanvil x210 V2 IP phones allows attackers on the local network to store arbitrary files on the device filesystem. This affects Fanvil x210 V2 devices running firmware version 2.12.20. Attackers must have network access to the vulnerable device.
💻 Affected Systems
- Fanvil x210 V2 IP Phone
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could upload malicious firmware or scripts to gain persistent access, modify device functionality, or use the device as a pivot point for lateral movement within the network.
Likely Case
Attackers upload web shells or malicious scripts to compromise the device, potentially leading to credential theft, surveillance, or denial of service.
If Mitigated
With proper network segmentation and access controls, impact is limited to the isolated device with no lateral movement possible.
🎯 Exploit Status
Exploitation requires network access but no authentication. Public proof-of-concept exists in GitHub advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://fanvil.com
Restart Required: No
Instructions:
Check Fanvil website for firmware updates. If available, download latest firmware and follow vendor upgrade instructions.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Fanvil phones on separate VLAN with restricted access
Access Control Lists
allImplement firewall rules to restrict access to phone management interfaces
🧯 If You Can't Patch
- Segment vulnerable devices on isolated network with no access to critical systems
- Monitor network traffic to/from Fanvil devices for unusual file upload activity
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or phone display. If version is 2.12.20, device is vulnerable.Check Version:
Access device web interface at http://[device-ip] and check System Information or use phone display menuVerify Fix Applied:
After firmware update, verify version is no longer 2.12.20. Test file upload functionality from unauthorized network segments.📡 Detection & Monitoring
Log Indicators:
- Unusual file upload requests to phone management interface
- Multiple failed authentication attempts followed by successful file upload
Network Indicators:
- HTTP POST requests to file upload endpoints from unauthorized IP addresses
- Unusual outbound connections from Fanvil devices
SIEM Query:
source="fanvil-phone" AND (url="*upload*" OR method="POST") AND NOT src_ip IN [authorized_admin_ips]