Ilevia EVE X1 Server CVE-2025-34513

Exploitation requires network reachability to the EVE X1 Server's web service on TCP port 8080 and the presence of the vulnerable mbus_build_from_csv.php endpoint, which is present in all firmware versions ≤ 4.7.18.0.eden. No authentication, user interaction, or special configuration is needed (PR:N/UI:N/AC:L), so default internet-facing deployments are directly exploitable. The primary limiting factor is deployment exposure: the vendor's only recommended mitigation is to avoid exposing port 8080 to the internet, so devices behind proper network segmentation or NAT/firewall are not remotely reachable, reducing the attack surface to adjacent-network or on-LAN attackers. No vendor patch is available, so mitigation depends entirely on network controls.

This is a genuine high-priority issue, not an inflated high-CVSS score. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with high confidentiality, integrity, and availability impact on the vulnerable system, consistent with the description of unauthenticated OS command injection yielding arbitrary code execution. Multiple signals reinforce each other: a public exploit exists (ZeroScience ZSL-2025-5962), and the EPSS score of 7.62% sits in the 94th percentile - elevated relative to most CVEs and consistent with public POC availability, though still an absolute-low probability indicating exploitation is plausible but not yet proven widespread. The vulnerability is NOT listed in CISA KEV, so there is no confirmed active exploitation. A key risk-amplifying factor is that the vendor (Ilevia) has explicitly declined to remediate, meaning no patch exists; the only mitigation is network segmentation (not exposing port 8080). The main factor limiting real-world risk is the product's niche deployment footprint (building/home automation controller) rather than any technical barrier to exploitation.

An attacker locates an internet-exposed Ilevia EVE X1 Server with port 8080 reachable and sends a crafted unauthenticated HTTP request to mbus_build_from_csv.php, injecting shell metacharacters into a parameter that is passed to an OS command. The injected command executes with the web service's privileges, giving the attacker arbitrary command execution on the controller. A public proof-of-concept (ZeroScience ZSL-2025-5962) is available, lowering the skill required to reproduce the attack.