The Fanvil X7A firmware 2.6.0.1182 contains an unauthenticated WebSocket handler that fails to enforce authentication checks. This flaw allows any network user to connect to the device via the WebSocket interface and retrieve sensitive information such as operational logs and diagnostic data. The ability to read these resources can lead to compromise of device configuration and internal state, potentially exposing sensitive call detail information or system settings.

The vulnerability affects Fanvil X7A devices running firmware version 2.6.0.1182. No other vendor or product versions are specified in the advisory. It is assumed that earlier or later firmware releases are unaffected unless confirmed by the vendor.

Because the vulnerability does not require prior authentication, an attacker can exploit it from any client that can reach the device's WebSocket endpoint. The lack of an EPSS score means the likelihood of exploitation is unclear, but the impact is high due to direct access to device logs. The vulnerability is not listed in CISA's KEV catalog, suggesting no publicly known exploits. Nonetheless, the absence of authentication represents a significant security risk, and any untrusted network connection could be used for data exfiltration.