EUVD-2025-34805

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a use of default credentials vulnerability that allows an unauthenticated attacker to obtain remote access. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet...

CVE-2025-34184

Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains an unauthenticated OS command injection vulnerability in the /ajax/php/login.php script. Remote attackers can execute arbitrary system commands by injecting payloads into the 'passwd' HTTP POST parameter, leading to full system compromise or...

CVE-2025-34186

Ilevia EVE X1/X5 Server (≤ 4.7.18.0.eden) contains a pre-authentication authentication bypass via unsanitized input passed to a system() call, where non-zero exit codes are treated as success, enabling remote attackers to bypass authentication and gain full system access. Related disclosures ment...