CVE-2025-34184

critical

Description

Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains an unauthenticated OS command injection vulnerability in the /ajax/php/login.php script. Remote attackers can execute arbitrary system commands by injecting payloads into the 'passwd' HTTP POST parameter, leading to full system compromise or denial of service.

References

Exploits
More

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5956.php

https://packetstorm.news/files/id/207717/

https://www.vulncheck.com/advisories/ilevia-eve-x1-server-neuro-code-unauth-code-injection

https://www.ilevia.com/

Details

Source: Mitre, NVD

Published: 2025-09-16

Updated: 2025-09-17

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

CVSS v4

Base Score: 9.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Severity: Critical

EPSS

EPSS: 0.00632