Critical Vulnerability Information Vulnerability Name: Ilevia EVE X1 Server 4.7.18.0.eden Reflected XSS Severity: MEDIUM Date: October 16, 2025 Affected Versions: EVE X1 Server <= 4.7.18.0.eden CVE ID: CVE-2025-34512 CWE ID: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') CVSS Score: 5.1 CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N References: - Zero Science Lab Disclosure - Ilevia Product Site Discoverer: Gjoko Krstic of Zero Science Lab Description: Ilevia EVE X1 Server firmware versions <= 4.7.18.0.eden contain a reflected cross-site scripting (XSS) vulnerability in index.php that allows an unauthenticated attacker to execute arbitrary code. Ilevia has declined to service this vulnerability and recommends that customers not expose port 8080 to the internet.