The Fanvil X7A firmware version 2.6.0.1182 lacks cross‑origin resource protection in its request handler, allowing state‑changing requests from any origin. This flaw permits attackers to perform Cross‑Site Request Forgery, tricking an authenticated user or the device to execute unintended actions such as modifying configuration or disrupting service. Since no CSRF tokens or origin checks are enforced, the attack can be carried out simply by hosting a malicious web page that triggers HTTP requests to the device.

The Fanvil X7A VoIP phone running firmware 2.6.0.1182 is the only product impacted; no other vendors or product versions are currently reported as vulnerable.

The CVSS score of 8.8 marks the flaw as high severity. The EPSS score of <1% suggests a low probability of exploitation, and the vulnerability is not listed in CISA KEV. The likely attack vector is a malicious web page that forces the user's browser to send authenticated requests to the device’s management interface. An attacker would not need privileged access beyond the ability to host a page that can reach the device. If the device’s management interface is exposed to the Internet or connected networks, the risk is moderate to high; otherwise, the exposure is limited.