Ilevia vulnerabilities
We track 14 vulnerabilities in Ilevia products. 14 are rated high or critical, and none are known to be exploited. The most recent was published on November 25, 2025.
Latest Ilevia vulnerabilities
- 9.6 Critical severity
Eve X1 Server Firmware: Improper Neutralization of Input During Web Page Generation
Cross Site Request Forgery (CSRF) vulnerability in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before, Logic Version v6.00 - 2025_07_21 allows a remote attacker to execute arbitrary code via the /bh_web_backend component
- 9.8 Critical severity
Eve X1 Server Firmware: Improper Neutralization of Special Elements used in an OS Command
An issue in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before Logic Version v6.00 - 2025_07_21 and before allows a remote attacker to execute arbitrary code via the ping.php component does not perform secure filtering on IP parameters
- 7.5 High severity
EVE X1 Server: Use of a Broken or Risky Cryptographic Algorithm
Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an insecure hashing algorithm vulnerability. The product stores passwords using the MD5 hash function without applying a per‑password salt. Because MD5 is a fast, unsalted hash, an attacker who obt
- 7.5 High severity
EVE X1 Server: Improper Limitation of a Pathname to a Restricted Directory
Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a relative path traversal vulnerability in get_file_content.php that allows an attacker to read arbitrary files. Ilevia has declined to service this vulnerability, and recommends that customers not
- 7.5 High severity
EVE X1 Server: Improper Limitation of a Pathname to a Restricted Directory
Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an absolute path traversal vulnerability in get_file_content.php that allows an attacker to read arbitrary files. Ilevia has declined to service this vulnerability, and recommends that customers no
- 9.8 Critical severity
EVE X1 Server: Use of Default Credentials
Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a use of default credentials vulnerability that allows an unauthenticated attacker to obtain remote access. Ilevia has declined to service this vulnerability, and recommends that customers not expo
- 9.8 Critical severity
EVE X1 Server: Execution with Unnecessary Privileges
Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an execution with unnecessary privileges vulnerability in sync_project.sh that allows an attacker to escalate privileges to root. Ilevia has declined to service this vulnerability, and recommends t
- 8.8 High severity
EVE X1 Server: Improper Neutralization of Special Elements used in an OS Command
Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain authenticated OS command injection vulnerabilities in multiple web-accessible PHP scripts that call exec() and allow an authenticated attacker to execute arbitrary commands. Ilevia has declined to
- 9.8 Critical severity
EVE X1 Server: Improper Neutralization of Special Elements used in an OS Command
Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an OS command injection vulnerability in mbus_build_from_csv.php that allows an unauthenticated attacker to execute arbitrary code. Ilevia has declined to service this vulnerability, and recommends
- 8.8 High severity
EVE X1/X5 Server: Improper Neutralization of Special Elements used in an OS Command
Ilevia EVE X1/X5 Server version ≤ 4.7.18.0.eden contains a misconfiguration in the sudoers file that allows passwordless execution of certain Bash scripts. If these scripts are writable by web-facing users or accessible via command injection, attackers can rep
- 9.8 Critical severity
EVE X1/X5 Server: Improper Neutralization of Special Elements used in an OS Command
Ilevia EVE X1/X5 Server version ≤ 4.7.18.0.eden contains a vulnerability in its authentication mechanism. Unsanitized input is passed to a system() call for authentication, allowing attackers to inject special characters and manipulate command parsing. Because
- 7.5 High severity
EVE X1 Server: Improper Limitation of a Pathname to a Restricted Directory
Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains a pre-authentication file disclosure vulnerability via the 'db_log' POST parameter. Remote attackers can retrieve arbitrary files from the server, exposing sensitive system information and credentials.
- 9.8 Critical severity
EVE X1 Server: Improper Neutralization of Special Elements used in an OS Command
Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains an unauthenticated OS command injection vulnerability in the /ajax/php/login.php script. Remote attackers can execute arbitrary system commands by injecting payloads into the 'passwd' HTTP POST parameter, l
- 7.5 High severity
EVE X1 Server: Insertion of Sensitive Information into Log File
Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains a vulnerability in its server-side logging mechanism that allows unauthenticated remote attackers to retrieve plaintext credentials from exposed .log files. This flaw enables full authentication bypass and