CVE-2025-60738
Published: 20 November 2025
Summary
CVE-2025-60738 is a critical-severity OS Command Injection (CWE-78) vulnerability in Ilevia Eve X1 Server Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the lack of secure filtering on IP parameters in ping.php by requiring validation of inputs to prevent command injection.
Ensures timely remediation of the command injection flaw through firmware updates for affected Ilevia EVE X1 Server versions.
Restricts IP parameters to valid formats and quantities, mitigating injection attempts by blocking malformed inputs to ping.php.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a command injection in the public-facing ping.php web component, enabling unauthenticated remote arbitrary code execution, directly facilitating T1190: Exploit Public-Facing Application.
NVD Description
An issue in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before Logic Version v6.00 - 2025_07_21 and before allows a remote attacker to execute arbitrary code via the ping.php component does not perform secure filtering on IP parameters
Deeper analysisAI
CVE-2025-60738 is a critical command injection vulnerability (CWE-78) affecting Ilevia EVE X1 Server Firmware versions v4.7.18.0.eden and earlier, as well as Logic Versions prior to v6.00-2025_07_21. The flaw exists in the ping.php component, which does not perform secure filtering on IP parameters, allowing remote attackers to execute arbitrary code. Published on 2025-11-20, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
A remote attacker can exploit this vulnerability over the network without authentication, privileges, or user interaction. By crafting malicious IP parameters in requests to ping.php, the attacker achieves arbitrary code execution on the server, resulting in high-impact confidentiality, integrity, and availability violations, such as full system compromise.
The primary reference is a GitHub repository at https://github.com/iSee857/ilevia-EVE-X1-Server, which provides details on the vulnerability but does not specify official patches or mitigation steps in the available information.
Details
- CWE(s)