PT-2025-49597 · Ilevia · Ilevia Eve X1 Server

Niix330 · Published 2025-12-08 · Updated 2025-12-08 · CVE-2025-14276

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Ilevia EVE X1 Server versions up to 4.6.5.0.eden

Description A command injection issue exists in Ilevia EVE X1 Server. The issue is related to the manipulation of an argument line in the file /ajax/php/leaf search.php. The attack can be initiated remotely and requires a high degree of complexity, but exploitability is considered difficult. The exploit has been publicly disclosed. The vendor confirms the issue and states that it is already solved on most devices and advises customers to close the port to the outside world.

Recommendations Upgrade the affected component to a version later than 4.6.5.0.eden. Close the port to the outside world.

Exploit

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2025-14276

Affected Products

Ilevia Eve X1 Server

References · 7

• 🔥 https://yuque.com/yuqueyonghuexlgkz/zepczx/ahygt5u6sgqpk5tt?singleDoc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-14276 · Security Note
• https://vuldb.com/?ctiid.334802 · Note
• https://vuldb.com/?submit.715521 · Note
• https://vuldb.com/?submit.702649 · Note
• https://twitter.com/CVEnew/status/1998148859130679763 · Twitter Post
• https://vuldb.com/?id.334802 · Note