Cyber Resilience

CVE-2025-34187

CriticalPublic PoCRCE

Published: 16 September 2025

Published
16 September 2025
Modified
25 September 2025
KEV Added
Patch
CVSS Score v4 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0190 83.6th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-34187 is a critical-severity OS Command Injection (CWE-78) vulnerability in Ilevia Eve X1 Server Firmware. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Sudo and Sudo Caching (T1548.003); ranked in the top 16.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and CM-6 (Configuration Settings).

Deeper analysis

Ilevia EVE X1/X5 Server versions up to and including 4.7.18.0.eden contain a sudoers file misconfiguration that permits passwordless execution of specific Bash scripts. The flaw is tracked under CVE-2025-34187 with a CVSS 4.0 score of 9.3 and is associated with CWE-78 and CWE-269. When the scripts are writable by web-facing users or reachable through command injection, the configuration enables replacement of the scripts with attacker-controlled content.

An unauthenticated remote attacker can leverage the misconfiguration to obtain full root privileges on the affected server. Successful exploitation results in remote privilege escalation and complete system compromise. The current EPSS score stands at 0.0190 with an identical peak value, indicating limited observed exploitation interest to date.

Public references including advisories from VulnCheck and Zero Science along with a Packet Storm disclosure provide further technical details on the issue.

EU & UK References

Vulnerability details

Ilevia EVE X1/X5 Server version ≤ 4.7.18.0.eden contains a misconfiguration in the sudoers file that allows passwordless execution of certain Bash scripts. If these scripts are writable by web-facing users or accessible via command injection, attackers can replace them with…

more

malicious payloads. Execution with sudo grants full root access, resulting in remote privilege escalation and potential system compromise.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1548.003 Sudo and Sudo Caching Privilege Escalation
Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

Sudoers misconfiguration enables passwordless root execution of writable Bash scripts (T1548.003); command injection path via scripts maps to Unix shell abuse (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-34514Same product: Ilevia Eve X1 Server
CVE-2025-34184Same product: Ilevia Eve X1 Server
CVE-2025-34513Same product: Ilevia Eve X1 Server
CVE-2025-34186Same product: Ilevia Eve X1 Server
CVE-2025-60738Same product: Ilevia Eve X1 Server
CVE-2025-34515Same product: Ilevia Eve X1 Server
CVE-2025-60739Same product: Ilevia Eve X1 Server
CVE-2025-34516Same product: Ilevia Eve X1 Server
CVE-2026-45152Shared CWE-78
CVE-2025-22495Shared CWE-78

Affected Assets

ilevia
eve x1 server firmware
≤ 4.7.18.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Enforces least privilege by restricting sudo to essential commands with authentication, directly mitigating passwordless root execution of vulnerable scripts.

prevent

Mandates secure configuration of sudoers file and script permissions to prevent misconfigurations allowing low-privileged web users to write or replace scripts.

prevent

Prohibits nonessential sudo capabilities and rules, eliminating unnecessary passwordless script executions that enable privilege escalation.

References