CVE-2025-60738

Critical · 9.8

CVSS

9.8

EPSS

1.1%

Published

Nov 20, 2025

CISA due date

—

The record

An issue in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before Logic Version v6.00 - 2025_07_21 and before allows a remote attacker to execute arbitrary code via the ping.php component does not perform secure filtering on IP parameters

Affected packages

Ecosystem	Package	Introduced	Fixed