The diagnostic ping tool in the web‑based management portal of Fanvil x7a firmware 2.6.0.1182 fails to securely handle user input, allowing an unauthenticated attacker to inject arbitrary shell commands. This flaw results in remote execution of code within the underlying Android operating system, giving the attacker full control over the device.

The vulnerability applies to Fanvil x7a units running firmware version 2.6.0.1182, as identified in the advisory. No other firmware versions or devices are explicitly affected based on the current data.

The CVSS score of 9.8 indicates a critical severity. The exploit path involves sending crafted input to the diagnostic ping endpoint exposed through the device’s web management console. The EPSS score is unavailable and the issue is not listed in the CISA KEV catalog, so the exact likelihood of exploitation cannot be quantified. However, because the flaw enables arbitrary command execution on the host OS, successful exploitation would lead to complete compromise of the device.