EVE X1 Server CVE-2025-34514

Requires valid authenticated access to the EVE X1 Server web interface, which listens on TCP port 8080; any authenticated user can reach the multiple vulnerable PHP scripts that pass input to exec(). Affects firmware versions ≤ 4.7.18.0.eden. No user interaction and no special non-default feature is needed beyond the standard web service being reachable. The primary limiting factors are: (1) authentication is mandatory (PR:L), so attackers need credentials or an auth bypass; and (2) the vendor-recommended mitigation of keeping port 8080 off the internet, when followed, confines the attack surface to the local/management network. Because the vendor will not issue a fix, exposure is governed entirely by network placement and account security.

This is a genuine but conditionally-gated risk rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and base score of 8.7 indicate a network-reachable, low-complexity flaw with full VC:H/VI:H/VA:H impact - consistent with authenticated OS command injection (CWE-78) yielding complete device compromise. The critical gating signal is PR:L: exploitation requires valid authentication to the EVE X1 web interface, which materially limits opportunistic mass exploitation. EPSS is 1.99% at the 80th percentile - elevated but not alarming, suggesting moderate exploitation interest rather than active mass campaigns. There is no CISA KEV listing and no explicit POC flag in the input, so there is no confirmation of active exploitation. The signals are internally consistent (authenticated network flaw, moderate EPSS, no KEV), with no contradiction between the CVSS vector and the description. The most important real-world modifier is the vendor posture: Ilevia has declined to remediate and advises not exposing port 8080 to the internet, meaning there is no patch - risk must be managed entirely through network segmentation and credential hygiene. Prioritize for any deployment where port 8080 is internet-exposed or where untrusted users can authenticate.

An attacker who holds or phishes valid credentials for the EVE X1 web interface (reachable on port 8080) sends a crafted request to one of the vulnerable PHP scripts, injecting shell metacharacters into a parameter passed to exec(). The server executes the attacker's commands with the privileges of the web service, giving full control over the automation controller. Risk rises sharply where port 8080 is exposed to the internet against the vendor's explicit recommendation; no public exploit is confirmed in the provided data, though a ZeroScience advisory is referenced.