Ilevia EVE X1 Server Cross-Site Request Forgery Vulnerability Allowing Arbitrary Code Execution

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in Ilevia EVE X1 Server Firmware Version 4.7.18.0.eden and earlier, as well as Logic Version 6.00 - 2025_07_21. This vulnerability allows remote attackers to execute arbitrary code via the /bh_web_backend component. The issue is exacerbated by the presence of DOM-based Cross-Site Scripting (XSS), which can be exploited to access internal system data and execute JavaScript code.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of code on the server.

Reproduction

To reproduce this vulnerability, send a POST request to the /ajax/php/bh_web_backend.php endpoint. Include a 'p' parameter with a value that contains a script tag, such as '13<script>alert(document.domain)</script>'. This request can be made manually or through a crafted form that submits the same data. The server's response will include key internal data, demonstrating the vulnerability's impact.