CISA and Ilevia Report Multiple Critical Vulnerabilities in EVE X1 Industrial Servers
Take action: If you are using Ilevia systems, review the advisory in detail. As usual isolate all industrial devices from the internet and make them accessible only from trusted networks. Make sure to close port 8080. Then plan a quick patch cycle, there are a bunch of critical easily exploited flaws. And be aware that some flaws remain, the vendor refused to patch them.
Learn More
CISA and Ilevia, an Italian automation firm, report nine security vulnerabilities affecting its EVE X1 Server, which is used in the critical manufacturing sector. These flaws include critical command injections and authentication bypasses that allow unauthenticated attackers to gain full control over the server. T
Vulnerabilities summary:
- CVE-2025-34184 (CVSS score 9.8) - An unauthenticated OS command injection vulnerability in the
/ajax/php/login.phpscript. Attackers can inject malicious payloads into the 'passwd' POST parameter to run arbitrary system commands. This allows for complete system takeover or service disruption without valid credentials. - CVE-2025-34183 (CVSS score 9.8) - A logging flaw that stores plaintext credentials in publicly accessible .log files. Remote attackers can read these files to obtain administrative passwords and bypass authentication entirely. This leads to full system compromise through credential reuse.
- CVE-2025-34186 (CVSS score 9.8) - An authentication bypass vulnerability where unsanitized input is passed to a
system()call. Attackers can manipulate command parsing to force a non-zero exit code, which the binary incorrectly interprets as a successful login. This grants unauthorized access to the management interface. - CVE-2025-34187 (CVSS score 9.8) - A privilege escalation vulnerability caused by a misconfigured
sudoersfile. Attackers who gain initial access can execute specific Bash scripts with root privileges without a password. By replacing these writable scripts with malicious code, attackers achieve full root control. - CVE-2025-34513 (CVSS score 9.8) - An OS command injection vulnerability in the
mbus_build_from_csv.phpcomponent. Unauthenticated attackers can send crafted requests to execute arbitrary code on the underlying operating system. - CVE-2025-34185 (CVSS score 7.5) - A pre-authentication path traversal vulnerability in the
db_logparameter. Attackers can use this to read arbitrary files from the server's filesystem. - CVE-2025-34517 (CVSS score 7.5) - An absolute path traversal vulnerability in get_file_content.php that allows an attacker to read arbitrary files.
- CVE-2025-34518 (CVSS score 7.5) - A relative path traversal vulnerability in get_file_content.php that allows an attacker to read arbitrary files.
- CVE-2025-34512 (CVSS score 5.4) - A reflected cross-site scripting (XSS) vulnerability in index.php enabling arbitrary code execution in a user's browser.
The vulnerabilities affect all Ilevia EVE X1 Server versions up to and including 4.7.18.0.
Some fixes are available but Ilevia declined to patch several reported flaws, including CVE-2025-34517, CVE-2025-34518, CVE-2025-34512, and CVE-2025-34513.
Users should update to the latest version of Ilevia Manager and close port 8080 on all routers and firewalls to prevent external access to the vulnerable web interface.
