Vulnerability · Published Sep 16, 2025 · Assigned by VulnCheck

CVE-2025-34186Ilevia EVE X1/X5 Server 4.7.18.0.eden Authentication Bypass

Critical 9.3

In plain English

A critical-severity improper authentication in EVE X1/X5 Server from Ilevia Srl.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.9%top 40.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Ilevia EVE X1/X5 Server version ≤ 4.7.18.0.eden contains a vulnerability in its authentication mechanism. Unsanitized input is passed to a system() call for authentication, allowing attackers to inject special characters and manipulate command parsing. Because the binary interprets non-zero exit codes from system() as successful authentication, remote attackers can bypass authentication and gain full access to the system.

Affected products (as reported)

Vendor	Product	Versions
Ilevia Srl.	EVE X1/X5 Server	0 – through 4.7.18.0.eden (Logic version: 6.00)

Weakness: CWE-287, CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.ilevia.com/ product
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5958.php technical-description, exploit
https://packetstorm.news/files/id/208871/ exploit
https://www.vulncheck.com/advisories/ilevia-eve-x1-x5-server-auth-bypass third-party-advisory