CVE-2025-60739 is a critical Cross-Site Request Forgery (CSRF) vulnerability affecting Ilevia EVE X1 Server Firmware versions v4.7.18.0.eden and earlier, and Logic versions v6.00 - 2025_07_21. This flaw allows a remote attacker to execute arbitrary code by exploiting the /bh_web_backend component. The vulnerability carries a CVSS score of 9.6 (CRITICAL), indicating a severe risk. It has a low attack complexity and requires user interaction (UI:R), but successful exploitation can lead to complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). While there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB) is currently unavailable. However, the vulnerability has garnered significant community attention with 10 mentions, suggesting a high level of interest among security researchers.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
4.7.18.0CPE matchmatch criteria | cpe:2.3:o:ilevia:eve_x1_server_firmware:4.7.18.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.8 Bluesky, 0.5 Mastodon, and 1.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.
Remediation records are not available for this CVE.