CVE-2025-70515: n/a

The device log component in Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user input. This lack of input sanitization permits injection of arbitrary HTML, which can be leveraged to execute malicious JavaScript code in any browser that renders the device log component, constituting a reflected cross-site scripting (XSS) vulnerability.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser when viewing the device log component. This can lead to session hijacking, defacement, or other malicious actions within the browser session. There is no information about exploitation in the wild or additional impact details.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the device log component to trusted users only and avoid viewing logs in untrusted environments.