CVE-2025-34512: medium-severity vulnerability in Ilevia Srl. EVE X1 Server
Ilevia EVE X1 Server 4.7.18.0.eden Reflected XSS
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.1epss 0.4%
Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a reflected cross-site scripting (XSS) vulnerability in index.php that allows an unauthenticated attacker to execute arbitrary script in the victim's browser. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Affected products
Ilevia Srl. · EVE X1 ServerRelated CVEs — Ilevia Srl. EVE X1 Server
In the same product, most dangerous first.
CVE-2025-34515CRITICALIlevia EVE X1 Server 4.7.18.0.eden Root Privilege EscalationEPSS 8.4%CVE-2025-34513CRITICALIlevia EVE X1 Server 4.7.18.0.eden Unauthenticated Command InjectionEPSS 7.6%CVE-2025-34184CRITICALIlevia EVE X1 Server 4.7.18.0.eden Neuro-Core Unauthenticated Code InjectionEPSS 2.7%CVE-2025-34514HIGHIlevia EVE X1 Server 4.7.18.0.eden Authenticated Command InjectionEPSS 2.0%CVE-2025-34185HIGHIlevia EVE X1 Server 4.7.18.0.eden Unauthenticated File DisclosureEPSS 0.8%CVE-2025-34183CRITICALIlevia EVE X1 Server 4.7.18.0.eden Credentials Leak Through Log DisclosureEPSS 0.7%