CVE-2025-34515

Summary

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an execution with unnecessary privileges vulnerability in sync_project.sh that allows an attacker to escalate privileges to root. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.

Affected Software

Weaknesses

• CWE-250: CWE-250 Execution with Unnecessary Privileges

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: total

References

• https://www.ilevia.com/
• https://www.vulncheck.com/advisories/ilevia-eve-x1-server-root-priv-esc
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5965.php

• ←Previous
• Next→