Fanvil vulnerabilities
We track 4 vulnerabilities in Fanvil products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on December 5, 2025.
Latest Fanvil vulnerabilities
- 9.6 Critical severity
X210 Firmware: Improper Neutralization of Input During Web Page Generation
A reflected Cross Site Scripting (XSS) vulnerability on Fanvil x210 2.12.20 devices allows attackers to cause a denial of service or potentially execute arbitrary commands via crafted POST request to the /cgi-bin/webconfig?page=upload&action=submit endpoint.
- 7.5 High severity
X210 Firmware: Buffer Copy without Checking Size of Input
A Buffer overflow vulnerability on Fanvil x210 2.12.20 devices allows attackers to cause a denial of service or potentially execute arbitrary commands via crafted POST request to the /cgi-bin/webconfig?page=upload&action=submit endpoint.
- 8.3 High severity
X210 Firmware: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in Fanvil x210 V2 2.12.20 allows unauthenticated attackers on the local network to store files in arbitrary locations and potentially modify the system configuration or other unspecified impacts.
- 9.8 Critical severity
X210 Firmware: Improper Authentication
An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to access administrative functions of the device (e.g. file upload, firmware update, reboot...) via a crafted authentication bypass.