CVE-2025-34187
Published: 16 September 2025
Summary
CVE-2025-34187 is a critical-severity OS Command Injection (CWE-78) vulnerability in Ilevia Eve X1 Server Firmware. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Sudo and Sudo Caching (T1548.003); ranked in the top 16.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and CM-6 (Configuration Settings).
Deeper analysis
Ilevia EVE X1/X5 Server versions up to and including 4.7.18.0.eden contain a sudoers file misconfiguration that permits passwordless execution of specific Bash scripts. The flaw is tracked under CVE-2025-34187 with a CVSS 4.0 score of 9.3 and is associated with CWE-78 and CWE-269. When the scripts are writable by web-facing users or reachable through command injection, the configuration enables replacement of the scripts with attacker-controlled content.
An unauthenticated remote attacker can leverage the misconfiguration to obtain full root privileges on the affected server. Successful exploitation results in remote privilege escalation and complete system compromise. The current EPSS score stands at 0.0190 with an identical peak value, indicating limited observed exploitation interest to date.
Public references including advisories from VulnCheck and Zero Science along with a Packet Storm disclosure provide further technical details on the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-29644
Vulnerability details
Ilevia EVE X1/X5 Server version ≤ 4.7.18.0.eden contains a misconfiguration in the sudoers file that allows passwordless execution of certain Bash scripts. If these scripts are writable by web-facing users or accessible via command injection, attackers can replace them with…
more
malicious payloads. Execution with sudo grants full root access, resulting in remote privilege escalation and potential system compromise.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Sudoers misconfiguration enables passwordless root execution of writable Bash scripts (T1548.003); command injection path via scripts maps to Unix shell abuse (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces least privilege by restricting sudo to essential commands with authentication, directly mitigating passwordless root execution of vulnerable scripts.
Mandates secure configuration of sudoers file and script permissions to prevent misconfigurations allowing low-privileged web users to write or replace scripts.
Prohibits nonessential sudo capabilities and rules, eliminating unnecessary passwordless script executions that enable privilege escalation.