Vulnerability · Published Oct 16, 2025 · Assigned by VulnCheck

CVE-2025-34514Ilevia EVE X1 Server 4.7.18.0.eden Authenticated Command Injection

High 8.7

In plain English

A high-severity OS command injection in EVE X1 Server from Ilevia Srl.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)2.0%top 19.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain authenticated OS command injection vulnerabilities in multiple web-accessible PHP scripts that call exec() and allow an authenticated attacker to execute arbitrary commands. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.

Affected products (as reported)

Vendor	Product	Versions
Ilevia Srl.	EVE X1 Server	0 – through 4.7.18.0.eden

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.ilevia.com/ product
https://www.vulncheck.com/advisories/ilevia-eve-x1-server-auth-command-injection third-party-advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5966.php technical-description, exploit