Ilevia EVE X1 Server vulnerabilities

In Ilevia EVE X1 Server firmware (version v4.7.18.0.eden and earlier), a CSRF vulnerability allows a remote attacker to execute arbitrary code via the /bh_web_backend component.

An issue in Ilevia EVE X1 Server Firmware versions up to v4.7.18.0.eden and Logic Version up to v6.00 - 2025_07_21 allows a remote attacker to execute arbitrary code via the ping.php component, which does not perform secure filtering on IP parameters.

A vulnerability was determined in Ilevia EVE X1 Server up to 4.6.5.0.eden. An unknown function of the file /ajax/php/leaf_search.php is impacted; manipulation of the argument line causes command injection. The attack can be initiated remotely and requires a high degree of complexity, though the exploit has been publicly disclosed.