The Fanvil X7A firmware 2.6.0.1182 contains a WebSocket handler that fails to enforce authentication restrictions for sessionless users, constituting an authentication bypass (CWE‑306). This flaw allows any network user to connect to the device’s WebSocket interface and retrieve device resources such as operational logs or perform diagnostic requests. The lack of authentication controls can expose sensitive information contained in these logs and diagnostic data, compromising the confidentiality of the device’s operational state.

The vulnerability affects Fanvil X7A devices running firmware version 2.6.0.1182. No other vendors or product versions are indicated as affected. Earlier or later firmware releases are not specified as vulnerable in the supplied data.

The CVSS score is 9.1, indicating a high severity. Exploitation does not require prior authentication and can be performed by any client that can reach the WebSocket endpoint on the device. EPSS is not available, and the vulnerability is not listed in CISA KEV, so no publicly known exploits are documented. Nonetheless, the high CVSS score reflects the significant impact of unauthorized access to logs and diagnostic requests.