CVE-2025-34515

🗓️ 16 Oct 2025 17:54:36Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 4 Views🌐 WEB

CVE-2025-34515: Ilevia EVE X1 Server up to 4.7.18.0.eden has root privilege escalation via sync_project.sh.

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2025-34515	16 Oct 202517:54	–	attackerkb
Circl	CVE-2025-34515	17 Oct 202501:34	–	circl
CNNVD	Ilevia EVE X1 Server 安全漏洞	16 Oct 202500:00	–	cnnvd
Cvelist	CVE-2025-34515 Ilevia EVE X1 Server 4.7.18.0.eden Root Privilege Escalation	16 Oct 202517:54	–	cvelist
EUVD	EUVD-2025-34804	16 Oct 202517:54	–	euvd
NVD	CVE-2025-34515	16 Oct 202518:15	–	nvd
OSV	CVE-2025-34515	16 Oct 202518:15	–	osv
Packet Storm	📄 Ilevia EVE X1/X5 Server 4.7.18.0.eden Root Privilege Escalation	10 Nov 202500:00	–	packetstorm
Packet Storm	📄 Ilevia EVE X1/X5 Server 4.7.18.0.eden Root Privilege Escalation	17 Dec 202500:00	–	packetstorm
RedhatCVE	CVE-2025-34515	17 Oct 202518:44	–	redhatcve

NVD

Vulners

CNA

Node

ilevia eve_x1_server_firmwareRange≤4.7.18.0

AND

ilevia eve_x1_serverMatch-

[
  {
    "defaultStatus": "unknown",
    "modules": [
      "mbus_build_from_csv.php"
    ],
    "product": "EVE X1 Server",
    "vendor": "Ilevia Srl.",
    "versions": [
      {
        "lessThanOrEqual": "4.7.18.0.eden",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
vulncheck	www.vulncheck.com/advisories/ilevia-eve-x1-server-root-priv-esc
zeroscience	www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5965.php
ilevia	www.ilevia.com/

Parameter	Position	Path	Description	CWE
ip	request body	/ajax/php/ping.php	Command injection via ping.php parameter ip enabling overwrite/addition to sync_project.sh due to writable script and sudoers misconfig	CWE-250
db_log	request body	/ajax/php/dbcheck.php	Potential command handling vulnerability via db_log parameter that could trigger arbitrary command execution	CWE-250

15 May 2026 11:15Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.19.8

CVSS 49.3

EPSS0.00245

SSVC

CWE-250