CVE-2025-34186 is a critical (CVSS 9.8) authentication bypass in Ilevia EVE X1 and X5 Server versions up to 4.7.18.0.eden. Unsanitized input reaches a system call used for login, and the result is read as success. No fix is confirmed, so isolate the server.
What's affected
The VulnCheck advisory lists EVE X1/X5 Server 4.7.18.0.eden and earlier. It names no fixed version and no workaround, and it does not describe a vendor response. It credits the researcher Gjoko Krstic of Zero Science Lab and was published on 16 September 2025.
The companion issue CVE-2025-34184 affects the same product line, so treat both together.
How to check if you're exposed
Read the version in the device interface. 4.7.18.0.eden or earlier is in range for both the X1 and the X5.
Check network exposure: look for port forwards, cloud relay settings and public addresses that lead to the server. Then review the authentication log for logins that succeeded without a matching valid account, or with strange characters in the credentials.
This is a shipped product or appliance, not a package you import, so a manifest scan will not list it. Use your asset inventory, procurement records or network discovery to find every instance, then compare the version you find against the fixed version in the vendor notes. Safeguard's free in-browser dependency scan and the Gold directory are useful for the open source parts of your estate, and you can look up this CVE in Gold to see how it is tracked.
What to do now
- Find all EVE X1 and X5 servers and record versions.
- Remove public exposure and require a VPN for any remote access.
- Segment the device from important systems.
- Ask Ilevia in writing for a fixed release and apply it when available.
- Review logs for unexplained administrative sessions.
- Replace the device if the vendor cannot supply a fix.
Why it matters
The record lists CWE-287, improper authentication, and CWE-78, OS command injection. The login code builds a command from input, and the binary treats any non-zero exit code from the call as a successful login. So an attacker who can make the command fail in the right way is logged in.
The design error is easy to miss: using the exit status of a shell call as the only proof of identity. A check should answer yes only on an explicit, positive result. The record does not flag exploitation in the wild, and the CVE is not on the CISA KEV list.
Quick check
What makes the bypass work?
The binary reads a non-zero exit code from the system call as a successful login, and unsanitized input can steer that call.
Sources
Last reviewed: 18 October 2026.
