CVE-2025-70519: n/a

The device log component in Fanvil x7a firmware 2.6.0.1182 does not properly sanitize or encode reflected user input. This lack of sanitization enables injection of arbitrary HTML, which can be leveraged to execute malicious JavaScript code in any browser that renders the device log component, constituting a reflected cross-site scripting (XSS) vulnerability.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of the victim's browser when viewing the device log component. This may lead to session hijacking, information disclosure, or other client-side attacks depending on the victim's interaction with the malicious script.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid exposing the device log component to untrusted users or networks. Implement network-level controls to restrict access to the affected interface.