CVE-2025-34514 Ilevia EVE X1 Server 4.7.18.0.eden Authenticated Command Injection
Authenticated attackers can execute arbitrary OS commands via PHP scripts in Ilevia EVE X1 Server; mitigate by restricting port 8080 access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-34514?
CVE-2025-34514 is a high-severity command injection vulnerability in Ilevia Srl. EVE X1 Server, published on 16 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain authenticated OS command injection vulnerabilities in multiple web-accessible PHP scripts that call exec() and allow an authenticated attacker to execute arbitrary commands. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.
Weakness: CWE-78
Which versions are affected by CVE-2025-34514?
It affects 1 product.
Products include Ilevia Eve X1 Server Firmware.
How do I fix CVE-2025-34514?
No fix has been published for CVE-2025-34514 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-34514 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-34514 exists.
Other vulnerabilities in Ilevia Srl. EVE X1 Server
- CVE-2025-60738 Command injection in n/a
- CVE-2025-60739 Cross-site request forgery in n/a
- CVE-2025-34513 Ilevia EVE X1 Server 4.7.18.0.eden Unauthenticated Command Injection
- CVE-2025-34515 Ilevia EVE X1 Server 4.7.18.0.eden Root Privilege Escalation
- CVE-2025-34516 Ilevia EVE X1 Server 4.7.18.0.eden Use of Default Credentials
Sources
Also known as GHSA-vrhc-cgwx-m2qw.