What’s Vulnerable › Vulnerabilities

CVE-2025-34184: Ilevia EVE X1 Server 4.7.18.0.eden Neuro-Core Unauthenticated Code Injection

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-09-16 · updated 2026-06-17
• Weakness: CWE-78

Description

Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains an unauthenticated OS command injection vulnerability in the /ajax/php/login.php script. Remote attackers can execute arbitrary system commands by injecting payloads into the 'passwd' HTTP POST parameter, leading to full system compromise or denial of service.

Affected products

• Ilevia Srl. EVE X1 Server: through 4.7.18.0

References

• https://packetstorm.news/files/id/207717/
• https://www.ilevia.com/
• https://www.vulncheck.com/advisories/ilevia-eve-x1-server-neuro-code-unauth-code-injection
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5956.php
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5956.php

Get alerted when CVE-2025-34184 or the next vulnerability affects your stack