EVE X1 Server CVE-2025-34512
MEDIUMSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a reflected cross-site scripting (XSS) vulnerability in index.php that allows an unauthenticated attacker to execute arbitrary code. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.
AnalysisAI
Reflected XSS in Ilevia EVE X1 Server firmware (all versions through 4.7.18.0.eden) exposes unauthenticated network attackers to client-side code execution by injecting malicious payloads via the index.php endpoint on port 8080. A publicly available proof-of-concept exploit exists (ZSL-2025-5961), raising the practical risk above the 5.1 CVSS score alone would suggest. Critically, Ilevia has formally declined to issue a patch, leaving all deployed devices permanently unmitigated at the firmware level - the only vendor-sanctioned control is network segmentation.
Technical ContextAI
The affected product is Ilevia EVE X1 Server firmware, a PHP-based building/home automation controller web interface identified by CPE cpe:2.3:o:ilevia:eve_x1_server_firmware:*:*:*:*:*:*:*:* (all versions through 4.7.18.0.eden). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), a reflected XSS class where user-supplied input arriving in an HTTP request is echoed back into the HTTP response without adequate sanitization or encoding. Because the sink is the index.php entry point of the web UI (listening on port 8080), any parameter or path component that is reflected into the rendered page is a potential injection vector. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) confirms the interface is network-accessible, requires no special configuration or prior authentication, and that exploitation demands the victim actively interact with a crafted link. Important: the 'RCE' tag applied to this CVE is a conflation - CWE-79/reflected XSS produces client-side JavaScript execution in the victim's browser context, not server-side remote code execution. Claims of full host-level RCE are not supported by the available CWE or CVSS data and should be independently verified.
RemediationAI
No vendor-released patch is available and none is expected - Ilevia has formally declined to service this vulnerability. The vendor's sole recommended compensating control is to block port 8080 from internet exposure, preventing external attackers from delivering malicious links that route through the public internet to the device. This is an actionable and specific step: configure perimeter firewall rules or ACLs to deny all inbound and outbound traffic on TCP port 8080 to/from EVE X1 Server IP addresses. Trade-off: this prevents remote management via the web UI from untrusted networks. For environments where remote access is operationally required, place the device behind a VPN gateway and restrict the web UI to VPN-only subnet access, eliminating the internet-facing attack surface entirely. Additionally, organizations should enforce strict anti-phishing controls and user awareness to reduce the likelihood of successful social engineering required for XSS delivery (UI:A). No additional workarounds have been published by the vendor. Advisory references: https://www.vulncheck.com/advisories/ilevia-eve-x1-server-reflected-xss and https://www.ilevia.com/.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today