CVE-2025-60738

Critical

Published: 20/11/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

An issue in Ilevia EVE X1 Server Firmware versions up to v4.7.18.0.eden and Logic Version up to v6.00 - 2025_07_21 allows a remote attacker to execute arbitrary code via the ping.php component, which does not perform secure filtering on IP parameters.

Risk Assessment

Remote code execution could allow an attacker to fully compromise the device and access the network it is connected to.

Recommendation

Update the firmware to the latest patched version and restrict access to the ping.php component.

Original NVD description (English source)

An issue in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before Logic Version v6.00 - 2025_07_21 and before allows a remote attacker to execute arbitrary code via the ping.php component does not perform secure filtering on IP parameters