Vulnerability · Published Sep 16, 2025 · Assigned by VulnCheck
CVE-2025-34183Ilevia EVE X1 Server 4.7.18.0.eden Credentials Leak Through Log Disclosure
Critical 9.3
In plain English
A critical-severity sensitive data in logs in EVE X1 Server from Ilevia Srl.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Severity (CVSS 4.0)9.3Critical
Exploit odds (30 days)0.7%top 46.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains a vulnerability in its server-side logging mechanism that allows unauthenticated remote attackers to retrieve plaintext credentials from exposed .log files. This flaw enables full authentication bypass and system compromise through credential reuse.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ilevia Srl. | EVE X1 Server | 0 – through 4.7.18.0.eden (Logic version: 6.00) |
Weakness: CWE-532 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://www.ilevia.com/ product
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5957.php technical-description, exploit
- https://packetstorm.news/files/id/208700/ exploit
- https://www.vulncheck.com/advisories/ilevia-eve-x1-server-credentials-leak-through-log-disclosure third-party-advisory