cbcvebase.
CVE-2025-60738
published 2025-11-20

CVE-2025-60738: An issue in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before Logic Version v6.00 - 2025_07_21 and before allows a remote attacker to execute…

PriorityP263critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.90%
55.0th percentile
An issue in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before Logic Version v6.00 - 2025_07_21 and before allows a remote attacker to execute arbitrary code via the ping.php component does not perform secure filtering on IP parameters

Affected

1 ranges
VendorProductVersion rangeFixed in
ileviaeve_x1_server_firmware——

Detection & IOCsextracted from sources · hover to see the quote

path/ajax/php/ping.php
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Ilevia ping.php ip Parameter Command Injection Attempt (CVE-2025-60738)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:18; content:"/ajax/php/ping.php"; fast_pattern; http.request_body; content:"ip|3d|"; pcre:"/^[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:url,github.com/iSee857/ilevia-EVE-X1-Server; reference:cve,2025-60738; classtype:attempted-admin; sid:2065845; rev:1; metadata:affected_product Ilevia, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_11_20, cve CVE_2025_60738, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_11_20, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
  • →Exploit traffic is HTTP POST only (not GET); filter on HTTP method POST to reduce false positives.
  • →The URI path is exactly 18 bytes: /ajax/php/ping.php — use a strict length match (bsize:18) to anchor detection.
  • →The POST body must contain the string 'ip=' (URL-encoded as ip|3d|) followed by shell injection metacharacters: semicolon (;/%3B), newline (\n/%0A), backtick (`/%60), pipe (|/%7C), or dollar sign ($/%24).
  • →Exploitation occurs over plaintext HTTP (not TLS); monitor unencrypted traffic to internal/perimeter hosts.
  • →The vulnerability is in the 'ip' parameter of ping.php which does not perform secure filtering, enabling OS command injection via shell metacharacters. ↗
  • ·Affected versions are EVE X1 Server Firmware v4.7.18.0.eden and before, and Logic Version v6.00 - 2025_07_21 and before; ensure version checks are part of asset scoping before deploying detections. ↗
  • ·The Snort/Suricata rule (SID 2065845) targets $HOME_NET as the destination; ensure $HOME_NET is correctly scoped to include Ilevia EVE X1 devices for accurate coverage.
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.