CVE-2025-60739

Critical

Description

Cross Site Request Forgery (CSRF) vulnerability in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before, Logic Version v6.00 - 2025_07_21 allows a remote attacker to execute arbitrary code via the /bh_web_backend component

SeverityCritical

CVSS9.6

Exploit probability—

ProductIlevia Eve X1 Server Firmware

PublishedNov 25, 2025

First seenNov 25, 2025

Weakness typeCWE-352Cross-site request forgery (CSRF)CWE-200Sensitive information exposure CWE-79Cross-site scripting (XSS)

How to fix

Sources list no fixed version or patch link for this vulnerability.

Affected products

Product	Affected versions	Fixed in
ilevia eve_x1_server_firmware	4.7.18.0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.