{"id":"CVE-2025-34514","state":"PUBLISHED","title":"Ilevia EVE X1 Server 4.7.18.0.eden Authenticated Command Injection","description":"Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain authenticated OS command injection vulnerabilities in multiple web-accessible PHP scripts that call exec() and allow an authenticated attacker to execute arbitrary commands. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.","publishedAt":"2025-10-16T17:56:16.188Z","updatedAt":"2026-05-15T11:15:44.906Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["Ilevia Srl. EVE X1 Server"],"affected":[{"vendor":"Ilevia Srl.","product":"EVE X1 Server","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.7.18.0.eden","versionType":"custom"}],"modules":["exec()"]}],"references":["https://www.ilevia.com/","https://www.vulncheck.com/advisories/ilevia-eve-x1-server-auth-command-injection","https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5966.php"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:09:03.054Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/34xxx/CVE-2025-34514.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-34514","state":"PUBLISHED","datePublished":"2025-10-16T17:56:16.188Z","dateUpdated":"2026-05-15T11:15:44.906Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2025-04-15T19:15:22.612Z"},"containers":{"cna":{"title":"Ilevia EVE X1 Server 4.7.18.0.eden Authenticated Command Injection","descriptions":[{"lang":"en","value":"Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain authenticated OS command injection vulnerabilities in multiple web-accessible PHP scripts that call exec() and allow an authenticated attacker to execute arbitrary commands. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet."}],"affected":[{"vendor":"Ilevia Srl.","product":"EVE X1 Server","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.7.18.0.eden","versionType":"custom"}],"modules":["exec()"]}],"references":[{"url":"https://www.ilevia.com/","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/ilevia-eve-x1-server-auth-command-injection","tags":["third-party-advisory"]},{"url":"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5966.php","tags":["technical-description","exploit"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-05-15T11:15:44.906Z"},"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:ilevia:eve_x1_server_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"4.7.18.0.eden","versionStartIncluding":"0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"credits":[{"lang":"en","type":"finder","value":"Gjoko Krstic of Zero Science Lab"}],"impacts":[{"capecId":"CAPEC-88","descriptions":[{"lang":"en","value":"CAPEC-88 OS Command Injection"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-12-22T19:21:39.691876Z","id":"CVE-2025-34514","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-12-22T19:21:45.790Z"}}]}}}