CVE-2025-34516

critical · 9.3

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a use of default credentials vulnerability that allows an unauthenticated attacker to obtain remote access. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.

9.3

CVSS

0.6%

EPSS (exploit prob.)

47th

EPSS percentile

2025-10-16

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-1392

Affected products

Vendor	Product	Affected versions
ilevia	eve_x1_server_firmware	<= 4.7.18.0
ilevia	eve_x1_server	all versions

Check a specific version with /api/v1/cve/match.

References

https://www.ilevia.com/
https://www.vulncheck.com/advisories/ilevia-eve-x1-server-use-of-default-credentials
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5963.php

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-34516