The request handler in Fanvil x7a firmware version 2.6.0.1182 fails to enforce cross‑origin restrictions for any state‑changing operation, which permits attackers to craft malicious web pages that trigger unintended actions against the device. This allows a remote actor to perform unauthorized configuration changes or service disruptions by leveraging the victim’s authenticated session, thereby compromising the device’s integrity and potentially exposing sensitive network information.

This flaw affects Fanvil x7a devices running firmware build 2.6.0.1182. No additional vendor or product versions are listed in the advisory.

Because the vulnerability is limited to Cross‑Site Request Forgery, exploitation requires that an attacker convince a logged‑in user to visit a malicious origin. The EPSS score is < 1% and the vulnerability is not listed in CISA KEV, so the current exploitation probability is low. Nevertheless, the ability to change device state without authorization presents a high risk to confidentiality and availability of the network segment served by the device, and the lack of same‑origin enforcement makes the attack vector trivial once a user’s session is established. The CVSS score of 8.8 indicates a high severity.