CVE-2025-34184: Ilevia Eve x1 Server Firmware

Critical severity, CVSS 9.8. EPSS: 2.7% chance of exploitation in the next 30 days.

Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains an unauthenticated OS command injection vulnerability in the /ajax/php/login.php script. Remote attackers can execute arbitrary system commands by injecting payloads into the 'passwd' HTTP POST parameter, leading to full system compromise or denial of service.

Affected products

• Ilevia Eve x1 Server Firmware: up to and including 4.7.18.0

Published 2025-09-16. Last modified 2026-06-17.