PT-2025-38074 · Ilevia · Ilevia Eve X1 Server

Gjoko Krstic · CVE-2025-34184 · Published 2025-09-16 · Updated 2025-09-25

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ilevia EVE X1 Server versions prior to 4.7.18.0.eden

Description Ilevia EVE X1 Server is susceptible to an unauthenticated OS command injection. Attackers can execute arbitrary system commands by injecting payloads into the passwd HTTP POST parameter of the /ajax/php/login.php API endpoint, potentially leading to full system compromise or denial of service.

Recommendations Versions prior to 4.7.18.0.eden should be updated. As a temporary workaround, restrict access to the /ajax/php/login.php API endpoint. Avoid using the passwd parameter in the /ajax/php/login.php API endpoint until the issue is resolved.

Exploit

Fix

DoS

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-34184

Affected Products

Ilevia Eve X1 Server

References · 12

• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2025-5956.php · Exploit
• 🔥 https://packetstorm.news/files/id/207717 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-34184 · Security Note
• https://osv.dev/vulnerability/CVE-2025-34184 · Vendor Advisory
• https://t.me/cveNotify/136393 · Telegram Post
• https://twitter.com/CVEnew/status/1968190777185513728 · Twitter Post
• https://ilevia.com · Note
• https://t.me/cveNotify/136295 · Telegram Post
• https://vulncheck.com/advisories/ilevia-eve-x1-server-neuro-code-unauth-code-injection · Note
• https://twitter.com/VulmonFeeds/status/1968091158380216376 · Twitter Post
• https://t.me/CVEtracker/32680 · Telegram Post
• https://twitter.com/offseq/status/1968148151258292335 · Twitter Post