Ilevia EVE X1 Server 4.7.18.0.eden Reflected XSS

Advisories

severity: medium
date: October 16, 2025
Affecting: EVE X1 Server <= 4.7.18.0.eden
CVE: CVE-2025-34512
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
CVSS: 5.1
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
References: Zero Science Lab Disclosure
Ilevia Product Site
Credit: Gjoko Krstic of Zero Science Lab
Description: Ilevia EVE X1 Server firmware versions <= 4.7.18.0.eden contain a reflected cross-site scripting (XSS) vulnerability in index.php that allows an unauthenticated attacker to execute arbitrary code. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.