Cyber Posture

CVE-2025-34184

CriticalPublic PoCRCE

Published: 16 September 2025

Published
16 September 2025
Modified
25 September 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0250 85.4th percentile
Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-34184 is a critical-severity OS Command Injection (CWE-78) vulnerability in Ilevia Eve X1 Server Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 14.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly prevents OS command injection by requiring validation mechanisms for the unsanitized 'passwd' HTTP POST parameter in login.php.

prevent

Mandates timely identification, reporting, and correction of the specific input sanitization flaw enabling command injection.

preventdetect

Boundary protection mechanisms like web application firewalls monitor and block remote unauthenticated payloads targeting the vulnerable login endpoint.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

Direct unauthenticated OS command injection in a public-facing web script (/ajax/php/login.php) enables remote exploitation of the application (T1190) and arbitrary Unix shell command execution (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains an unauthenticated OS command injection vulnerability in the /ajax/php/login.php script. Remote attackers can execute arbitrary system commands by injecting payloads into the 'passwd' HTTP POST parameter, leading to full system compromise or…

more

denial of service.

Deeper analysisAI

CVE-2025-34184 is an unauthenticated OS command injection vulnerability (CWE-78) affecting Ilevia EVE X1 Server versions up to and including 4.7.18.0.eden. The flaw resides in the /ajax/php/login.php script, where the 'passwd' HTTP POST parameter fails to properly sanitize input, allowing attackers to inject and execute arbitrary system commands.

Remote, unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction required, as indicated by its CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Successful exploitation enables full system compromise through arbitrary command execution or denial of service by disrupting system availability.

Advisories from VulnCheck, Zero Science, and PacketStorm provide further details, including proof-of-concept exploits, while the vendor site at ilevia.com may offer additional guidance. No specific patches or mitigations are detailed in the CVE description.

Details

CWE(s)

Affected Products

ilevia
eve x1 server firmware
≤ 4.7.18.0

CVEs Like This One

CVE-2025-34513Same product: Ilevia Eve X1 Server
CVE-2025-34514Same product: Ilevia Eve X1 Server
CVE-2025-60738Same product: Ilevia Eve X1 Server
CVE-2025-34186Same product: Ilevia Eve X1 Server
CVE-2025-34187Same product: Ilevia Eve X1 Server
CVE-2025-60739Same product: Ilevia Eve X1 Server
CVE-2025-34515Same product: Ilevia Eve X1 Server
CVE-2025-34516Same product: Ilevia Eve X1 Server
CVE-2026-25070Shared CWE-78
CVE-2026-34796Shared CWE-78

References