CVE-2025-60739

Critical

Published: 25/11/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

In Ilevia EVE X1 Server firmware (version v4.7.18.0.eden and earlier), a CSRF vulnerability allows a remote attacker to execute arbitrary code via the /bh_web_backend component.

Risk Assessment

An attacker can exploit CSRF to perform unauthorized operations in the context of a logged-in user, potentially compromising system integrity.

Recommendation

Update firmware to a patched version and implement CSRF protection mechanisms.

Original NVD description (English source)

Cross Site Request Forgery (CSRF) vulnerability in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before, Logic Version v6.00 - 2025_07_21 allows a remote attacker to execute arbitrary code via the /bh_web_backend component