CVE-2025-34186 Details
Description
Ilevia EVE X1/X5 Server version ≤ 4.7.18.0.eden contains a vulnerability in its authentication mechanism. Unsanitized input is passed to a system() call for authentication, allowing attackers to inject special characters and manipulate command parsing. Because the binary interprets non-zero exit codes from system() as successful authentication, remote attackers can bypass authentication and gain full access to the system.
An authentication bypass vulnerability has been identified in Ilevia EVE X1/X5 Server versions through 4.7.18.0.eden. The issue arises from the application's authentication mechanism, which improperly handles user input. Unsanitized input is passed to a system() call for authentication, allowing remote attackers to inject special characters and manipulate command parsing. The vulnerability exploits the binary's interpretation of non-zero exit codes as successful authentication, enabling attackers to bypass authentication and gain full access to the system.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 16, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://packetstorm.news/files/id/208871/ | [email protected] | ExploitThird Party Advisory |
| https://www.ilevia.com/ | [email protected] | Product |
| https://www.vulncheck.com/advisories/ilevia-eve-x1-x5-server-auth-bypass | [email protected] | Third Party Advisory |
| https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5958.php | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
| CWE-287 | Improper Authentication | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ilevia eve x1 server firmware | <= 4.7.18.0 |
CPE
Remediation
| |
| ilevia eve x1 server | All versions |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | CVE Modified | [email protected] |
| Sep 25, 2025 | Reanalysis | [email protected] |
| Sep 24, 2025 | Initial Analysis | [email protected] |
| Sep 16, 2025 | New CVE Received | [email protected] |