CVE-2025-34512 is a reflected cross-site scripting (CWE-79) vulnerability affecting Ilevia Srl.'s EVE X1 Server firmware versions up to 4.7.18.0.eden. The flaw exists in the index.php page, where improper neutralization of input allows unauthenticated attackers to inject and execute arbitrary scripts in users' browsers. This can lead to potential impacts such as session hijacking or malicious script execution. The vendor has explicitly declined to service this vulnerability and advises customers not to expose the server's port 8080 externally. No official patch or fix is available, and no known exploits have been reported.

An unauthenticated attacker can exploit this reflected XSS vulnerability to execute arbitrary scripts in the context of a victim's browser when accessing the vulnerable index.php page. This could lead to typical XSS impacts such as theft of session tokens, redirection to malicious sites, or other script-based attacks. However, the vendor has not provided a fix, and the risk is mitigated primarily by restricting external access to port 8080. There are no known active exploits in the wild.

Since Ilevia Srl. has declined to provide a patch or fix for this vulnerability, the recommended mitigation is to avoid exposing port 8080 of the EVE X1 Server to the internet. Network-level controls such as firewall rules should be used to restrict access to trusted internal networks only. Monitor vendor communications for any future updates or changes in remediation status.