VULNERABILITY INTELLIGENCE

CVE-2025-34187

CVSS score8.8 HIGH

EPSS probability3.27%

CISA KEVNot currently listed

Published2025-09-16

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

Ilevia EVE X1/X5 Server version ≤ 4.7.18.0.eden contains a misconfiguration in the sudoers file that allows passwordless execution of certain Bash scripts. If these scripts are writable by web-facing users or accessible via command injection, attackers can replace them with malicious payloads. Execution with sudo grants full root access, resulting in remote privilege escalation and potential system compromise.

Weakness classification

disclosure@vulncheck.com: CWE-78

Primary references

disclosure@vulncheck.com — Exploit, Permissions Required, Third Party Advisory
disclosure@vulncheck.com — Product
disclosure@vulncheck.com — Third Party Advisory
disclosure@vulncheck.com — Exploit, Third Party Advisory