CVE-2025-34513

CRITICAL 9.8CVE-2025-34513 · Published 16/10/2025 · updated 09/10/2026

In short

CVE-2025-34513 is a CRITICAL (CVSS 9.8) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 7.6%, higher than 94.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an OS command injection vulnerability in mbus_build_from_csv.php that allows an unauthenticated attacker to execute arbitrary code. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.

References

ilevia.com · Product
vulncheck.com/advisories/ilevia-eve-x1-server-unauth-command-injection · Third Party Advisory
zeroscience.mk/en/vulnerabilities/ZSL-2025-5962.php · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free