Overview
CVE-2025-64055 describes a critical security vulnerability affecting Fanvil x210 V2 VoIP phones running firmware version 2.12.20. This vulnerability allows unauthenticated attackers on the same local network to bypass authentication mechanisms and gain access to sensitive administrative functions of the device. This includes, but is not limited to, file uploads, firmware updates, and device reboot.
Technical Details
The vulnerability resides in the authentication process of the Fanvil x210 V2. A crafted request, exploiting a flaw in how the device handles authentication tokens or session management, can circumvent the normal login procedures. Attackers can leverage this to access administrative interfaces without providing valid credentials. The specific technical details of the exploit are available in the linked advisories. Successful exploitation grants the attacker full control over the phone’s configuration.
CVSS Analysis
Currently, the CVSS score and severity for CVE-2025-64055 are listed as N/A. However, given the ability to execute administrative functions without authentication, the likely severity of this vulnerability is considered to be critical. Awaiting official CVSS score from NVD is important for accurate assessment.
Possible Impact
The successful exploitation of CVE-2025-64055 can have severe consequences:
- Complete compromise of the VoIP phone: Attackers can modify configurations, intercept calls, and access sensitive data.
- Denial of Service: Attackers can reboot the device, rendering it unusable.
- Network compromise: The compromised phone can be used as a foothold for further attacks within the local network.
- Firmware manipulation: Attackers can install malicious firmware, potentially creating a backdoor for persistent access.
Mitigation or Patch Steps
The following steps are recommended to mitigate the risks associated with CVE-2025-64055:
- Apply the patch: Upgrade the Fanvil x210 V2 firmware to a version that addresses this vulnerability. Check the Fanvil official website for the latest firmware updates and security advisories.
- Network Segmentation: Isolate VoIP phones on a separate VLAN to limit the potential impact of a compromise.
- Access Control: Implement network access control lists (ACLs) to restrict access to the VoIP phones’ management interface from unauthorized networks.
- Monitor Network Traffic: Monitor network traffic for suspicious activity targeting the VoIP phones.
