CVE-2025-64056

File upload vulnerability in Fanvil x210 V2 2.12.20 allows unauthenticated attackers on the local network to store arbitrary files on the filesystem.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
http://fanvil.com	Product
https://github.com/SpikeReply/advisories/blob/main/cve/fanvil/cve-2025-64056.md	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:fanvil:x210_firmware:2.12.20:*:*:*:*:*:*:*

cpe:2.3:h:fanvil:x210:2.0:*:*:*:*:*:*:*

History

09 Jan 2026, 02:18

Type	Values Removed	Values Added
CPE	cpe:2.3:h:tenda:x210:2.0:::::::* cpe:2.3:o:tenda:x210_firmware:2.12.20:::::::*	cpe:2.3:o:fanvil:x210_firmware:2.12.20:::::::* cpe:2.3:h:fanvil:x210:2.0:::::::*
First Time		Fanvil Fanvil x210 Fanvil x210 Firmware

11 Dec 2025, 18:15

Type	Values Removed	Values Added
References	~~() http://fanvil.com -~~	() http://fanvil.com - Product
References	~~() https://github.com/SpikeReply/advisories/blob/main/cve/fanvil/cve-2025-64056.md -~~	() https://github.com/SpikeReply/advisories/blob/main/cve/fanvil/cve-2025-64056.md - Exploit, Third Party Advisory
First Time		Tenda Tenda x210 Tenda x210 Firmware
CPE		cpe:2.3:h:tenda:x210:2.0:::::::* cpe:2.3:o:tenda:x210_firmware:2.12.20:::::::*

08 Dec 2025, 17:16

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.3
CWE		CWE-306

05 Dec 2025, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-12-05 16:15

Updated : 2026-01-09 02:18

NVD link : CVE-2025-64056

Mitre link : CVE-2025-64056

CVE.ORG link : CVE-2025-64056

JSON object : View

Products Affected

fanvil

x210
x210_firmware

CWE

CWE-306

Missing Authentication for Critical Function

4.3 /10