Ilevia EVE X1 Server Remote Code Execution Vulnerability
Vulnerability
A remote code execution vulnerability exists in Ilevia EVE X1 Server firmware versions through 4.7.18.0.eden and logic versions through 6.00 - 2025_07_21. The issue arises in the ping.php component, which fails to properly validate IP parameters, allowing remote attackers to execute arbitrary code.
Impact
Exploitation of this vulnerability allows for arbitrary code execution on the server.
Reproduction
To reproduce this vulnerability, send a POST request to '/ajax/php/ping.php' without a valid IP address in the 'ip' parameter. The server will respond with a status indicating the execution of the injected command, demonstrating the successful execution of arbitrary code.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.