CVE-2025-34186 Ilevia EVE X1/X5 Server 4.7.18.0.eden Authentication Bypass
Remote attackers can bypass authentication and execute arbitrary commands via unsanitized input in the Ilevia EVE Server authentication mechanism.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-34186?
CVE-2025-34186 is a critical command injection vulnerability in Ilevia Srl. EVE X1/X5 Server, published on 16 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Ilevia EVE X1/X5 Server version ≤ 4.7.18.0.eden contains a vulnerability in its authentication mechanism. Unsanitized input is passed to a system() call for authentication, allowing attackers to inject special characters and manipulate command parsing. Because the binary interprets non-zero exit codes from system() as successful authentication, remote attackers can bypass authentication and gain full access to the system.
Which versions are affected by CVE-2025-34186?
It affects 1 product.
Products include Ilevia Eve X1 Server Firmware.
How do I fix CVE-2025-34186?
No fix has been published for CVE-2025-34186 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-34186 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-34186 exists.
Other vulnerabilities in Ilevia Srl. EVE X1/X5 Server
- CVE-2025-60738 Command injection in n/a
- CVE-2025-60739 Cross-site request forgery in n/a
- CVE-2025-34513 Ilevia EVE X1 Server 4.7.18.0.eden Unauthenticated Command Injection
- CVE-2025-34515 Ilevia EVE X1 Server 4.7.18.0.eden Root Privilege Escalation
- CVE-2025-34516 Ilevia EVE X1 Server 4.7.18.0.eden Use of Default Credentials
Sources
Also known as GHSA-5jjw-fvhq-mw36.