The vulnerability CVE-2025-34515 affects Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden. It is classified as CWE-250 (Execution with Unnecessary Privileges) and occurs in the sync_project.sh script. This flaw permits an attacker to escalate privileges to root, potentially gaining full control over the affected system. The CVSS 4.0 base score is 9.3, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. The vendor has declined to issue a patch and recommends customers not expose the vulnerable service port (8080) to the internet.

Successful exploitation allows an unauthenticated attacker to escalate privileges to root on the affected EVE X1 Server, leading to full system compromise. This can result in complete loss of confidentiality, integrity, and availability of the system. Since the vendor has not provided a patch, the vulnerability remains unmitigated except by network exposure restrictions.

No official patch or fix is available as the vendor has declined to service this vulnerability. The vendor recommends that customers do not expose port 8080 to the internet to reduce the risk of exploitation. Organizations should implement network-level controls such as firewall rules or VPNs to restrict access to this port and monitor for any unauthorized access attempts.