Vulnerability Description
Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an absolute path traversal vulnerability in get_file_content.php that allows an attacker to read arbitrary files. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ilevia | Eve X1 Server Firmware | <= 4.7.18.0 |
| Ilevia | Eve X1 Server | - |
Related Weaknesses (CWE)
References
- https://www.ilevia.com/Product
- https://www.vulncheck.com/advisories/ilevia-eve-x1-server-absolute-path-traversaThird Party Advisory
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5960.phpExploitThird Party Advisory
FAQ
What is CVE-2025-34517?
CVE-2025-34517 is a vulnerability with a CVSS score of 7.5 (HIGH). Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an absolute path traversal vulnerability in get_file_content.php that allows an attacker to read arbitrary files. Ilevia has declined to ...
How severe is CVE-2025-34517?
CVE-2025-34517 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-34517?
Check the references section above for vendor advisories and patch information. Affected products include: Ilevia Eve X1 Server Firmware, Ilevia Eve X1 Server.