EVE X1 Server CVE-2025-34519

Exploitation requires the attacker to first obtain the EVE X1 Server's stored password database (the MD5 hash store) - this vulnerability does not itself provide a path to that store; it only makes recovered hashes trivially crackable. Concrete prerequisite: possession of the password/hash file, obtainable via exposure of the management service on port 8080, a separate access/disclosure flaw, or local/backup/physical access to firmware ≤ 4.7.18.0.eden. Limiting factor: this is an offline, post-access weakness, so impact is gated by whether an attacker can reach the hash store at all; the vendor-recommended control of keeping port 8080 off the internet substantially reduces real-world exposure. Once the database is obtained, the lack of salt and use of MD5 impose essentially no barrier to recovering plaintext passwords.

Signals are moderate and largely consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N, VC:H only) yields 8.2 (High), but the AT:P flag (attack requirement present) and VC:H-only impact reveal the true nature: this is an offline credential-recovery weakness that presupposes the attacker has ALREADY obtained the password database. The PR:N value is technically accurate for the hashing weakness itself but is misleading as a risk indicator - no network request directly triggers this; the attacker must first exfiltrate the hash store. EPSS is low at 0.31% (22nd percentile), which is coherent with the absence of KEV listing and no identified public exploit, and reflects that this is a secondary/post-compromise weakness rather than a directly weaponizable remote flaw. Net: this is NOT a drop-everything priority on its own. It materially amplifies the damage of any OTHER breach that exposes the EVE X1 password store (unsalted MD5 is trivially crackable), so it should be treated as a defense-in-depth / credential-hygiene issue. The vendor has declined to fix it, so the only remediation is the compensating control of not exposing port 8080.

An attacker who gains access to the EVE X1 Server's password store (for example via a separate flaw, an exposed port 8080 management interface, or local/backup access) copies the stored MD5 password hashes. Because the hashes are unsalted and MD5 is extremely fast, the attacker runs offline rainbow-table or GPU brute-force cracking to recover the plaintext passwords within minutes to hours. No public exploit is required - standard password-cracking tools suffice; no public exploit was identified at time of analysis.