CVE-2025-60738 Details
Description
An issue in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before Logic Version v6.00 - 2025_07_21 and before allows a remote attacker to execute arbitrary code via the ping.php component does not perform secure filtering on IP parameters
A remote code execution vulnerability exists in Ilevia EVE X1 Server firmware versions through 4.7.18.0.eden and logic versions through 6.00 - 2025_07_21. The issue arises in the ping.php component, which fails to properly validate IP parameters, allowing remote attackers to execute arbitrary code.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Nov 20, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/iSee857/ilevia-EVE-X1-Server | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| ilevia eve x1 server firmware | 4.7.18.0 |
CPE
Remediation
| |
| ilevia eve x1 server | All versions |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 15, 2026 | Initial Analysis | [email protected] |
| Nov 21, 2025 | CVE Modified | CISA-ADP |
| Nov 20, 2025 | CVE Modified | CISA-ADP |
| Nov 20, 2025 | New CVE Received | [email protected] |