CVE-2025-34184

CRITICAL 9.8CVE-2025-34184 · Published 16/09/2025 · updated 17/06/2026

In short

CVE-2025-34184 is a CRITICAL (CVSS 9.8) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 2.7%, higher than 86.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains an unauthenticated OS command injection vulnerability in the /ajax/php/login.php script. Remote attackers can execute arbitrary system commands by injecting payloads into the 'passwd' HTTP POST parameter, leading to full system compromise or denial of service.

References

packetstorm.news/files/id/207717 · Exploit
ilevia.com · Product
vulncheck.com/advisories/ilevia-eve-x1-server-neuro-code-unauth-code-injection · Third Party Advisory
zeroscience.mk/en/vulnerabilities/ZSL-2025-5956.php · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free