The device log component of Fanvil x7a firmware 2.6.0.1182 accepts user supplied data and returns it directly to a web browser without sanitization or encoding. When the log is viewed, an attacker can supply malicious HTML that is reflected, causing client‑side JavaScript to execute in the victim’s browser context. This classic reflected XSS (CWE‑79) can be leveraged to steal credentials, hijack the user session, deface the interface, or use the browser as a foothold for additional attacks.

All Fanvil x7a devices running firmware 2.6.0.1182 are affected; no other firmware revisions or vendor products are listed as impacted in the information provided.

The vulnerability requires that the attacker supply content that is subsequently rendered by a browser, thus exploitation is possible when a user visits the log component with malicious input. The CVSS score of 6.1 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog; the precise likelihood of exploitation is unclear, but the ability to inject client‑side code is a serious risk whenever the log component is reachable over a network and input is not properly validated. The issue is not listed in the CISA KEV catalog.