CVE-2025-34184

Name of the Vulnerable Software and Affected Versions Ilevia EVE X1 Server versions prior to 4.7.18.0.eden

Description Ilevia EVE X1 Server is susceptible to an unauthenticated OS command injection. Attackers can execute arbitrary system commands by injecting payloads into the passwd HTTP POST parameter of the /ajax/php/login.php API endpoint, potentially leading to full system compromise or denial of service.

Recommendations Versions prior to 4.7.18.0.eden should be updated. As a temporary workaround, restrict access to the /ajax/php/login.php API endpoint. Avoid using the passwd parameter in the /ajax/php/login.php API endpoint until the issue is resolved.