CVE-2025-34187

Severity CVSS v4.0:
CRITICAL
Type:
CWE-78 OS Command Injections
Publication date:
16/09/2025
Last modified:
25/09/2025

Description

Ilevia EVE X1/X5 Server version ≤ 4.7.18.0.eden contains a misconfiguration in the sudoers file that allows passwordless execution of certain Bash scripts. If these scripts are writable by web-facing users or accessible via command injection, attackers can replace them with malicious payloads. Execution with sudo grants full root access, resulting in remote privilege escalation and potential system compromise.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:ilevia:eve_x1_server_firmware:*:*:*:*:*:*:*:* 4.7.18.0 (including)
cpe:2.3:h:ilevia:eve_x1_server:-:*:*:*:*:*:*:*