PT-2025-38073 · Ilevia · Ilevia Eve X1 Server

Gjoko Krstic · Published 2025-09-16 · Updated 2025-09-25 · CVE-2025-34183

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Ilevia EVE X1 Server versions 4.7.18.0 and earlier

Description The server-side logging mechanism in Ilevia EVE X1 Server contains a flaw that allows unauthenticated remote attackers to retrieve plaintext credentials from exposed .log files. This enables full authentication bypass and system compromise through credential reuse.

Recommendations Update Ilevia EVE X1 Server to a version later than 4.7.18.0.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2025-34183

Affected Products

Ilevia Eve X1 Server

References · 11

• 🔥 https://packetstorm.news/files/id/208700 · Exploit
• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2025-5957.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-34183 · Security Note
• https://osv.dev/vulnerability/CVE-2025-34183 · Vendor Advisory
• https://t.me/cveNotify/136392 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1968098837970456616 · Twitter Post
• https://vulncheck.com/advisories/ilevia-eve-x1-server-credentials-leak-through-log-disclosure · Note
• https://ilevia.com · Note
• https://twitter.com/CVEnew/status/1968190778175320126 · Twitter Post
• https://t.me/cveNotify/136053 · Telegram Post
• https://t.me/CVEtracker/32679 · Telegram Post