CVE-2025-34187 describes an improper privilege management vulnerability (CWE-269) in Ilevia Srl.'s EVE X1/X5 Server (≤ 4.7.18.0.eden). The sudoers file is misconfigured to allow passwordless execution of specific Bash scripts. If these scripts are writable by users exposed to the web or accessible through command injection, attackers can replace them with malicious code. Since these scripts run with sudo privileges, exploitation results in full root access, enabling remote privilege escalation and potential system compromise. The vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity. No known exploits in the wild or vendor patches are currently documented.

Successful exploitation allows unauthenticated remote attackers to gain root privileges on the affected server by replacing writable Bash scripts executed via sudo without password. This leads to full system compromise, including unauthorized control over the server and potential further attacks within the environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict write permissions on the affected Bash scripts to trusted users only and audit sudoers configurations to remove passwordless execution where unnecessary. Avoid exposing writable scripts to web-facing users and sanitize inputs to prevent command injection.