CVE-2025-34513 is an OS command injection vulnerability (CWE-78) affecting Ilevia Srl.'s EVE X1 Server firmware versions ≤ 4.7.18.0.eden. The vulnerability exists in the mbus_build_from_csv.php script, which improperly neutralizes special elements in OS commands, allowing unauthenticated remote attackers to execute arbitrary code. The vendor has explicitly declined to service this vulnerability and recommends mitigating exposure by not allowing access to port 8080 from untrusted networks.

Successful exploitation enables unauthenticated attackers to execute arbitrary operating system commands on the affected server, potentially leading to full system compromise. Given the critical CVSS score of 9.3, the impact includes high confidentiality, integrity, and availability risks. No known exploits have been reported in the wild, but the vulnerability remains unpatched and exploitable if the vulnerable port is accessible.

No official patch or fix is available as the vendor has declined to service this vulnerability. The vendor recommends that customers do not expose port 8080 to the internet or untrusted networks to prevent remote exploitation. Network-level controls such as firewall rules or VPN access should be used to restrict access to the affected service. Patch status is not confirmed beyond vendor refusal; monitor vendor communications for any future updates.