External risk intelligence

Ilevia EVE X1 Server CSRF Vulnerability Allows Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2025-60739

The Ilevia EVE X1 Server is a building automation and control system often deployed with remote access capabilities. As a management and control gateway, these devices are commonly configured to be internet-accessible to allow for remote monitoring and operation, making the web interface component an internet-facing service.

Cross-site Scripting

Ilevia Eve X1 Server Firmware

4.7.18.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical Cross-Site Request Forgery vulnerability has been identified in the Ilevia EVE X1 Server firmware, potentially allowing unauthorized remote code execution. This impacts building automation systems and could be exploited through the web interface. The primary concern is confirming if this technology is in use and potentially exposed.

Attackers can trick users into running unauthorized actions.
This is a critical system; exposure is a high concern.
Confirm if this building automation system is in use.

Attack Path

How an attacker could exploit the issue

An attacker can exploit a Cross-Site Request Forgery (CSRF) vulnerability in the Ilevia EVE X1 Server firmware. This occurs when a user visits a malicious website that contains a crafted request targeting the vulnerable /bh_web_backend component. If the user is authenticated to the Ilevia EVE X1 Server, the malicious request can be executed without their explicit consent, potentially leading to arbitrary code execution.

Requires unauthenticated remote network access.
User visits a malicious website.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to perform unauthorized actions on the Ilevia EVE X1 Server when a user visits a malicious webpage. Such actions, if supported by the advisory, could potentially impact the device's configuration or operational state.

System configuration data at risk.
User interaction with a malicious page.
Unauthorized actions may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

Determining ownership for this Cross-Site Request Forgery vulnerability in Ilevia EVE X1 Server firmware requires identifying which team manages building automation systems and their network exposure. The first step is to locate all instances of the affected server firmware, assess their internet reachability and business criticality, and then identify the accountable system owner before planning remediation.

Identify and own affected systems.
Verify external reachability and criticality.
Coordinate vendor engagement and remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Ilevia EVE X1 Server used for?

The Ilevia EVE X1 Server is a building automation and control system. It acts as a management and control gateway, allowing administrators to integrate, monitor, and operate various smart building components through a centralized web interface.

What does this CSRF vulnerability mean for the server?

This CVE involves a Cross-Site Request Forgery (CSRF) weakness. It means an attacker can trick an authenticated user's browser into sending unauthorized commands to the server's /bh_web_backend component. Because the server trusts these forged requests, it can be manipulated into executing arbitrary code.

How does an attacker trigger this vulnerability?

The trigger requires a user who is currently logged into the EVE X1 Server interface to visit a malicious website. Simply navigating to the server's management page or using the device normally does not trigger the bug; the malicious request must be initiated from outside the trusted session by the attacker.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal indicates that EVE X1 Servers are frequently configured for remote access to support building management, often placing the web interface on the internet. If your server is reachable from the public internet, it falls into the high-risk category for this type of network-based attack.

What should I do first to manage this issue?

Begin by identifying all EVE X1 Server instances within your network environment. Once located, verify their network configuration to determine if they are exposed to the internet. Coordinate with the teams responsible for your building automation systems to assess the criticality of these devices and prepare for vendor-provided updates.

References

github.com/iSee857/ilevia-EVE-X1-Server-CSRF

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.