CVE-2025-34514 is an authenticated OS command injection vulnerability affecting Ilevia Srl.'s EVE X1 Server firmware versions ≤ 4.7.18.0.eden. The issue arises from multiple PHP scripts accessible via the web interface that improperly neutralize special elements in user input before passing them to the exec() function. This allows an attacker with valid authentication to execute arbitrary OS commands on the affected device. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity. The vendor has declined to issue a patch and advises customers not to expose the affected service port (8080) to the internet.

An authenticated attacker can execute arbitrary operating system commands on the affected EVE X1 Server, potentially leading to full system compromise, data disclosure, or disruption of service. The high CVSS score reflects the significant risk posed by this vulnerability. Since the vendor has not provided a fix, affected systems remain vulnerable if accessible.

No official patch or fix is available as the vendor has declined to service this vulnerability. The vendor recommends that customers do not expose port 8080, which hosts the vulnerable web interface, to the internet. Organizations should restrict network access to the affected server to trusted internal networks only and consider additional compensating controls such as network segmentation and access controls to limit authenticated user capabilities.