CVE-2025-34187 affects Ilevia EVE X1/X5 Server versions up to 4.7.18.0.eden, stemming from a sudoers misconfiguration that permits passwordless execution of specific Bash scripts. This allows attackers to achieve remote privilege escalation and full root access if they can modify these scripts or inject commands through web-facing interfaces. With a CVSS score of 8.8 (HIGH), the vulnerability is easily exploitable over the network with low complexity and user privileges, leading to complete compromise of confidentiality, integrity, and availability. Currently, there is no public exploit code, Metasploit module, or evidence of active exploitation, and it has received minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 4.7.18.0CPE matchmatch criteria | cpe:2.3:o:ilevia:eve_x1_server_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.