Ilevia EVE X1 Server 4.7.18.0.eden Use of Default Credentials

published 2025-10-16 12 mo ago modified 2026-10-09 31 d ago also EUVD-2025-34805

cvss: 9.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits: 0; none known

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a use of default credentials vulnerability that allows an unauthenticated attacker to obtain remote access. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: 12 mo ago (2025-10-16)

Exploit prediction

0.58% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

zeroscience.mk https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5963.php referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA	4.0	9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Ilevia Srl. EVE X1 Server

Classification

Weakness

CWE-1392 Use of Default Credentials

References

zeroscience.mk /en/vulnerabilities/ZSL-2025-5963.php
technical-description, exploit
ilevia.com /
product
vulncheck.com /advisories/ilevia-eve-x1-server-use-of-default-credentials
third-party-advisory

Sources

CVE List CVE-2025-34516
NVD CVE-2025-34516

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary