PT-2025-38075 · Ilevia · Ilevia Eve X1 Server

Gjoko Krstic · Published 2025-09-16 · Updated 2025-09-25 · CVE-2025-34185

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Ilevia EVE X1 Server versions prior to 4.7.18.0.eden

Description Ilevia EVE X1 Server versions prior to 4.7.18.0.eden contain a pre-authentication file disclosure issue via the db log POST parameter. Remote attackers can retrieve arbitrary files from the server, potentially exposing sensitive system information and credentials.

Recommendations Update Ilevia EVE X1 Server to version 4.7.18.0.eden or later. As a temporary workaround, restrict access to the db log POST parameter.

Exploit

Fix

Path traversal

Information Disclosure

Weakness Enumeration

CWE-22

CWE-200

Related Identifiers

CVE-2025-34185

Affected Products

Ilevia Eve X1 Server

References · 10

• 🔥 https://packetstorm.news/files/id/207716 · Exploit
• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2025-5955.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-34185 · Security Note
• https://osv.dev/vulnerability/CVE-2025-34185 · Vendor Advisory
• https://ilevia.com · Note
• https://t.me/CVEtracker/32681 · Telegram Post
• https://vulncheck.com/advisories/ilevia-eve-x1-server-unauth-file-disclosure · Note
• https://t.me/cveNotify/136394 · Telegram Post
• https://twitter.com/CVEnew/status/1968190776187203949 · Twitter Post
• https://t.me/cveNotify/136296 · Telegram Post