CVE-2025-34517 is an absolute path traversal vulnerability (CWE-22) found in the Ilevia Srl. EVE X1 Server firmware versions up to 4.7.18.0.eden. The vulnerability resides in the get_file_content.php endpoint, which fails to properly restrict or sanitize user-supplied file path input. This allows an attacker to craft requests that traverse directories outside the intended restricted directory, thereby reading arbitrary files on the server filesystem. The vulnerability can be exploited remotely without authentication or user interaction, over the network via the default port 8080. The impact is primarily on confidentiality, as attackers can access sensitive files such as configuration files, credentials, or other private data stored on the server. Ilevia has declined to provide a patch or fix for this issue and instead recommends that customers avoid exposing port 8080 to the internet, effectively placing the onus on users to mitigate risk through network segmentation or firewall rules. No known exploits have been observed in the wild yet, but the vulnerability's characteristics make it a significant risk. The CVSS v4.0 base score is 8.7, reflecting high severity due to network attack vector, no required privileges, no user interaction, and high confidentiality impact. The vulnerability affects all firmware versions up to and including 4.7.18.0.eden, with no exceptions noted. This vulnerability is particularly concerning for organizations relying on EVE X1 Server in environments where port 8080 is accessible externally or insufficiently protected.

The primary impact of CVE-2025-34517 is the compromise of confidentiality through unauthorized disclosure of arbitrary files on the affected EVE X1 Server. Attackers can access sensitive information such as system configuration files, credentials, private keys, or other critical data that may facilitate further attacks or data breaches. This can lead to loss of intellectual property, exposure of personally identifiable information (PII), or compromise of other connected systems. Since the vulnerability requires no authentication and no user interaction, it can be exploited by any remote attacker scanning for exposed port 8080 services. The lack of a vendor patch increases the risk, as organizations must rely on network controls to prevent exploitation. The availability and integrity of the system are not directly impacted by this vulnerability, but the confidentiality breach can have cascading effects on organizational security posture. Industries with critical infrastructure or sensitive data hosted on EVE X1 Servers are particularly at risk, potentially leading to regulatory penalties, reputational damage, and operational disruptions if exploited.

1. Immediately restrict access to port 8080 on all EVE X1 Servers by implementing strict firewall rules or network segmentation to prevent exposure to the internet or untrusted networks. 2. Deploy network intrusion detection/prevention systems (IDS/IPS) to monitor and block suspicious requests targeting get_file_content.php or unusual path traversal patterns. 3. Conduct thorough audits of EVE X1 Server deployments to identify any instances exposed externally or lacking adequate access controls. 4. Where possible, isolate EVE X1 Servers within secure internal networks with no direct internet access. 5. Implement strict logging and monitoring of all access to the vulnerable endpoint to detect potential exploitation attempts early. 6. Consider deploying web application firewalls (WAFs) with custom rules to detect and block path traversal payloads targeting the vulnerable script. 7. Engage with Ilevia or third-party security vendors for potential custom patches or mitigations if available. 8. Educate system administrators and security teams about the vulnerability and the importance of not exposing the service externally. 9. Develop incident response plans specifically addressing potential exploitation of this vulnerability. 10. Evaluate alternative products or firmware versions not affected by this vulnerability for long-term risk reduction.