Ilevia EVE X1 Server CVE-2025-34517

Requires network reachability to the EVE X1 Server HTTP interface on TCP port 8080; the vulnerable endpoint is get_file_content.php, which accepts an absolute file path and returns its contents with no authentication (PR:N) and no user interaction (UI:N). The primary limiting factor is exposure of port 8080 - the vendor explicitly recommends not exposing this port to the internet, so instances behind network segmentation or firewalls are not remotely reachable. No patch exists (vendor declined to service), so mitigation is purely network-level, and exploitation is only possible against firmware versions ≤ 4.7.18.0.eden.

Signals are moderately aligned toward a real but bounded risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with high confidentiality impact (VC:H) and no integrity or availability impact (VI:N/VA:N), yielding 8.7 (High) - consistent with an arbitrary file-read path traversal. Publicly available exploit code (ZeroScience ZSL-2025-5960) lowers the barrier to opportunistic use. However, EPSS is low at 0.66% (50th percentile), and there is NO CISA KEV listing, suggesting no confirmed widespread active exploitation despite the public POC - POC availability and active exploitation are distinct signals here. The most important risk modifier is that exploitation requires reachability of port 8080, and the vendor (Ilevia) has DECLINED to patch, instead advising customers not to expose port 8080 to the internet; this means remediation depends entirely on network segmentation rather than a fix. Net: a genuine high-confidentiality issue that is easy to exploit WHEN the service is internet-exposed, but its real-world blast radius is constrained by the niche building-automation deployment base and the fact that the standard mitigation keeps the port off the public internet.

An attacker who can reach the EVE X1 Server web service on port 8080 sends a crafted request to get_file_content.php supplying an absolute path, and the server returns the contents of an arbitrary file (e.g. configuration, credentials, or system files). A public POC exists (ZeroScience ZSL-2025-5960), and because no authentication is required and complexity is low, exploitation is straightforward against any exposed instance.