by Kastro
Paper/Archive/CVE-2025-34184

CVE-2025-34184

Ilevia Srl. EVE X1 Server — Ilevia EVE X1 Server 4.7.18.0.eden Neuro-Core Unauthenticated Code Injection

EPSS 3%public exploitCVSS 9.8
critical.is priorityof 100
57
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 86.2.862 × 2017.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains an unauthenticated OS command injection vulnerability in the /ajax/php/login.php script. Remote attackers can execute arbitrary system commands by injecting payloads into the 'passwd' HTTP POST parameter, leading to full system compromise or denial of service.

Affected

ProductAffectedFixed inSource
EVE X1 Server≤ 4.7.18.0.eden (Logic version: 6.00)–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refilevia.comexploitzeroscience.mk/en/vulnerabilities/ZSL-2025-5956.phpexploitpacketstorm.news/files/id/207717writeupvulncheck.com/advisories/ilevia-eve-x1-server-neuro-code-unauth-code-injection