CVE-2025-60739

PoC —

CVSS 3.1

9.6 critical

EPSS

<1%p26

Published

Nov 25, 2025 (Nov 25, 2025)

Modified

Jun 17, 2026

Description

Cross Site Request Forgery (CSRF) vulnerability in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before, Logic Version v6.00 - 2025_07_21 allows a remote attacker to execute arbitrary code via the /bh_web_backend component

Vendors: ilevia
Products: eve x1 server firmware
Weakness: CWE-79, CWE-200, CWE-352
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.