CVE-2025-64057
📋 TL;DR
An unauthenticated directory traversal vulnerability in Fanvil x210 V2 IP phones allows attackers on the local network to write files to arbitrary locations. This could lead to system configuration changes or other impacts. Only systems running the vulnerable firmware version are affected.
💻 Affected Systems
- Fanvil x210 V2
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could overwrite critical system files, modify configuration to enable persistent backdoors, or potentially achieve remote code execution by writing malicious scripts to executable locations.
Likely Case
Attackers modify phone configuration to redirect calls, enable unauthorized features, or disrupt phone functionality. Could be used as initial foothold for lateral movement.
If Mitigated
With proper network segmentation and access controls, impact limited to phone functionality disruption within isolated VLAN.
🎯 Exploit Status
Directory traversal vulnerabilities typically have low exploitation complexity. No public exploit code mentioned in references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://fanvil.com
Restart Required: Yes
Instructions:
1. Check Fanvil website for firmware updates. 2. Download latest firmware. 3. Upload to phone via web interface. 4. Reboot phone after update.
🔧 Temporary Workarounds
Network Segmentation
allIsolate IP phones on separate VLAN to limit attack surface
Access Control Lists
allImplement network ACLs to restrict access to phone management interfaces
🧯 If You Can't Patch
- Segment IP phones onto isolated VLAN with strict firewall rules
- Monitor network traffic to/from phones for unusual file transfer patterns
🔍 How to Verify
Check if Vulnerable:
Check firmware version in phone web interface: System > Status > Version. If version is 2.12.20, device is vulnerable.Check Version:
Not applicable - check via web interface or phone displayVerify Fix Applied:
After firmware update, verify version is no longer 2.12.20. Test file upload functionality with traversal payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual file write operations in system logs
- Multiple failed authentication attempts followed by file uploads
Network Indicators:
- HTTP POST requests with directory traversal sequences (../) to phone IP
- Unusual outbound connections from phone after file upload
SIEM Query:
source_ip=phone_ip AND (http_uri CONTAINS "../" OR http_method="POST" AND http_content_type="multipart/form-data")