CVE-2025-34515
Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an execution with unnecessary privileges vulnerability in sync_project.sh tha
CVSS
9.8
Crítica
EPSS
8.4%
p95
KEV
—
Exploit Today
29
0-100
Publicado: 16 de out. de 2025 · Última mod.: 9 de out. de 2026 · CWE-250
8.0%EPSS · 30 dias8.4%
2026-10-152026-11-11
Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an execution with unnecessary privileges vulnerability in sync_project.sh that allows an attacker to escalate privileges to root. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1215276.7 MÉD—
——0A execution with unnecessary privileges vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.7, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all versions may allow an authenticated local attacker with admin privileges to gain root shell access via CLI commands.8hCVE-2026-112174——
——0Local privilege escalation vulnerability in Iperius Backup 8.8.3, due to insufficient separation between the graphical user interface running with elevated privileges and local users with low privileges. When the backup service is configured to run persistently with Administrator privileges, a local attacker with low privileges can use the native Windows dialogues exposed by the application to run programmes that inherit its elevated context. This allows commands to be executed with SYSTEM or Administrator privileges, depending on the application’s context, and compromises the affected Windows system.2dCVE-2026-1208147.2 ALT30.8%
——9An improper privilege management issue in the sharding subsystem of MongoDB Server may allow a user holding certain shard-level administrative privileges to cause persisted internal coordination state to be reprocessed with elevated internal authority. Because that state is trusted rather than re-validated, operations may be carried out beyond the user's authorized scope, including changes to cluster-wide security configuration. Successful triggering this issue requires an authenticated session directly against a cluster member and can result in unauthorized access to and modification of data across the cluster.2dCVE-2026-1242268.8 ALT18.5%
——6Execution with unnecessary privileges in Windows PowerShell allows an authorized attacker to bypass a security feature locally.2dCVE-2026-1169297.5 ALT53.6%
——16Execution with unnecessary privileges in SQL Server allows an authorized attacker to elevate privileges over a network.2dCVE-2026-1216906.7 MÉD6.1%
——2FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) executes code with unnecessary privileges. All processes run as root and the system lacks privilege separation. The compromise of any single service results in full administrative control of the device.7h