EVE X1 Server CVE-2025-34518

The EVE X1 Server web service on port 8080 must be network-reachable by the attacker - the vendor's own mitigation is to NOT expose port 8080 to the internet, so exploitation is practically limited to instances that are internet-facing or reachable on a hostile network segment. No authentication is required (PR:N) and no user interaction is needed (UI:N); the attacker simply reaches the get_file_content.php endpoint on a vulnerable firmware build (≤ 4.7.18.0.eden) and supplies relative traversal input. The primary limiting factor is deployment exposure of port 8080 and the product's small installed base; there is no vendor patch, so network isolation/segmentation is the only defense.

Signals are moderately consistent and point to a real but bounded risk. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, and publicly available exploit code (ZeroScience ZSL-2025-5960) lowers the barrier to opportunistic use - this is the strongest escalating signal. However, impact is confidentiality-only (VC:H, VI:N, VA:N): an attacker can read arbitrary files but cannot directly modify data or disrupt service, which is why the score sits at 8.7 rather than near 10. EPSS is low-to-moderate (0.66%, 50th percentile) and the CVE is NOT in CISA KEV, so there is no evidence of active, widespread exploitation despite the available POC - do not conflate POC availability with in-the-wild use. The decisive risk amplifier is NON-TECHNICAL: the vendor (Ilevia) has explicitly DECLINED to patch and advises customers to keep port 8080 off the internet, meaning there is no fix and exposed instances remain permanently vulnerable. Net: a genuine priority for any organization running an internet-exposed EVE X1 Server, but the product's niche footprint and confidentiality-only impact keep it from being a broad, urgent emergency.

A remote, unauthenticated attacker locates an EVE X1 Server with port 8080 exposed to the internet and sends a crafted HTTP request to get_file_content.php containing relative path traversal sequences (e.g. ../../). The server returns the contents of arbitrary files outside the intended directory, allowing disclosure of configuration files, credentials, or other sensitive data. Public exploit code (ZeroScience ZSL-2025-5960) exists, so the attack requires no special skill and low complexity (AC:L).