CVE-2025-34184 is a critical (CVSS 9.8) unauthenticated OS command injection in Ilevia EVE X1 Server up to version 4.7.18.0.eden. The login.php script passes the password field to the system unsafely. No fixed version is confirmed, so isolate the server and ask the vendor.
What's affected
The record lists Ilevia EVE X1 Server version 4.7.18.0.eden and earlier, plus the server firmware. The vulnerable script is /ajax/php/login.php and the parameter is passwd.
The related VulnCheck advisories for this product family do not name a fixed version or a workaround. Check the Ilevia site and contact support for current firmware.
How to check if you're exposed
Open the EVE X1 administration interface and read the firmware or software version. 4.7.18.0.eden or earlier is in range.
Then ask whether the device is reachable from untrusted networks. Building automation and home automation servers are often exposed for remote access. Check router port forwarding and cloud relay settings for the server address. Review the web server log for unusual requests to the login script and for failed or oddly long password values.
This is a shipped product or appliance, not a package you import, so a manifest scan will not list it. Use your asset inventory, procurement records or network discovery to find every instance, then compare the version you find against the fixed version in the vendor notes. Safeguard's free in-browser dependency scan and the Gold directory are useful for the open source parts of your estate, and you can look up this CVE in Gold to see how it is tracked.
What to do now
- Inventory every Ilevia EVE server and note the version.
- Remove internet exposure and use a VPN for remote access.
- Place the server on a segmented network with no route to critical systems.
- Contact Ilevia for fixed firmware and ask for a timeline.
- Change administrator credentials, but do not treat that as a fix, since the flaw is before authentication.
- Check the device for unfamiliar accounts, processes or scheduled tasks.
Why it matters
The weakness is CWE-78, OS command injection. The login handler places the password value into a system command, so shell characters in the password can change what runs. Because it sits in the login step, no account is needed.
A login form is the most exposed code on any device, and it should treat every field as hostile data. The record leads to full system compromise or denial of service. It does not flag exploitation in the wild and the CVE is not on the CISA KEV list. There is a public disclosure for the product family, so unpatched devices are easy to find.
Quick check
Is a stronger password a mitigation?
No. The flaw is before authentication, so a strong password does not remove it. Isolate the device instead.
Sources
Last reviewed: 18 October 2026.
