EVE X1 Server CVE-2025-34516

Exploitation requires the EVE X1 Server's web/management interface on TCP port 8080 to be reachable by the attacker (the vendor explicitly warns against exposing port 8080 to the internet, confirming this is the attack surface), and requires the device to still use its factory-default credentials. No user interaction and no prior authentication are needed (PR:N/UI:N). The principal LIMITING factor is network reachability: a device isolated from untrusted networks or behind a firewall blocking port 8080 is not remotely exploitable, which is precisely the vendor-recommended mitigation since no patch exists. Any device left on default credentials with port 8080 exposed is fully exploitable.

Multiple signals point in different directions here. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H, score 9.3) describes a trivially exploitable, unauthenticated, network-reachable flaw yielding full confidentiality, integrity and availability impact - because it is a use-of-default-credentials issue (CWE-1392), exploitation is as simple as logging in with known factory credentials. However, the EPSS score is low at 0.58% (46th percentile), the vulnerability is NOT listed in CISA KEV, and no public exploit code is confirmed in the provided data. This gap between a near-maximal CVSS and low EPSS is characteristic of a critical flaw in a low-prevalence, niche product rather than a mass-exploited internet-scale target. A decisive aggravating factor is that the vendor (Ilevia) has explicitly declined to fix the issue, meaning there is no patch and the only mitigation is network segmentation - so any exposed device remains permanently vulnerable. Verdict: genuinely high real-world risk for any organization actually running an internet- or network-exposed EVE X1 Server on port 8080, but limited aggregate/widespread-campaign risk due to the product's small deployment footprint. Note the EPSS percentile reflects statistical likelihood of observed exploitation across the ecosystem, not the ease of exploitation, which is very high.

An attacker scans for Ilevia EVE X1 Servers exposing port 8080 and simply authenticates using the firmware's unchanged default credentials, gaining remote administrative access to the building/home-automation controller. Because no authentication barrier effectively exists (default creds are publicly documented), the attacker obtains full control over confidentiality, integrity, and availability of the device. No public exploit code is identified at time of analysis, though a ZeroScience advisory (ZSL-2025-5963) and a VulnCheck advisory document the issue.