EVE X1 Server CVE-2025-34515

Exploitation requires network reachability to the EVE X1 Server management service on TCP port 8080; the specific vulnerable component is the sync_project.sh script, which runs with unnecessary (root) privileges, so triggering its functionality yields root. The vendor's own mitigation - not exposing port 8080 to the internet - defines the primary limiting factor: devices on isolated/segmented building-automation networks are not reachable by external attackers. A key uncertainty that limits realistic risk is authentication: the description frames this as privilege 'escalation to root,' which may require an existing low-privileged account or web-interface session, even though the supplied CVSS vector marks PR:N; this should be confirmed against the vendor/ZeroScience advisory before treating it as fully unauthenticated. No user interaction is required (UI:N), and no patch exists because the vendor declined to service the issue.

Signals point in genuinely conflicting directions. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H, score 9.3) describes a trivially exploitable, network-reachable, unauthenticated flaw with total compromise of the system - a maximum-urgency profile. However, the description characterizes the issue as privilege escalation to root via sync_project.sh (CWE-250, execution with unnecessary privileges), and 'escalation to root' idiomatically implies an attacker already possesses some lower-privileged foothold, which is in tension with PR:N - verify with vendor/advisory whether port 8080 exposes the trigger to fully unauthenticated callers or only to authenticated web-interface users. EPSS is elevated (7.97%, 95th percentile), indicating above-average predicted exploitation likelihood, but there is NO CISA KEV listing and no confirmed public exploit flag in the input, so this is predicted/elevated interest rather than confirmed active exploitation. The most important risk-reducing fact is that the vendor (Ilevia) has declined to patch and instead advises not exposing port 8080 to the internet - meaning risk is almost entirely a function of network exposure, and internet-facing deployments are far more exposed than segmented building-automation networks. SSVC-style read: technical impact is total, automatability is plausible given AC:L/UI:N, but exploitation is not confirmed in-the-wild. Net: a real high-severity issue for internet-exposed devices, materially de-risked by its niche deployment footprint and the availability of a simple network-level mitigation.

An attacker who can reach the EVE X1 Server's management service on port 8080 interacts with the sync_project.sh functionality, which executes with unnecessary (root) privileges, to run commands or escalate to full root control of the automation server. Because the CVSS vector indicates low attack complexity and no user interaction, the action is straightforward against an exposed device; no public exploit is confirmed in the input, though the referenced ZeroScience advisory (ZSL-2025-5965) is the type typically containing technical reproduction detail.