CVE-2025-34512CWE-79cross-site-scripting

CVE-2025-34512

Medium · published October 16, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
33.9
In the wild
Unconfirmed
What it is

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a reflected cross-site scripting (XSS) vulnerability in index.php that allows an unauthenticated attacker to execute arbitrary script in the victim's browser. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00407 · 33.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-10-16T22:15Z
Affected products (1)
ProductVersionsFixed in
ilevia/eve_x1_server_firmware≤ 4.7.18.0—
References (3)
https://www.ilevia.com/ · [email protected]https://www.vulncheck.com/advisories/ilevia-eve-x1-server-reflected-xss · [email protected]https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5961.php · [email protected]
EPSS history
Timeline
  • 16 OCT 17:55Z
    Ilevia EVE X1 Server 4.7.18.0.eden Reflected XSS
    cvelistv5