The vulnerability identified as CVE-2025-34518 affects Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden. It is a CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) path traversal issue in the get_file_content.php endpoint. This allows remote attackers to read arbitrary files on the server without authentication by manipulating file path parameters. The vendor has explicitly declined to service or patch this vulnerability and recommends customers not expose the affected service port externally.

Successful exploitation enables an unauthenticated attacker to read arbitrary files on the affected server, potentially exposing sensitive information. The CVSS 4.0 base score is 8.7 (high), reflecting network attack vector, no privileges or user interaction required, and high impact on confidentiality. There is no indication of known exploits in the wild at this time.

No official patch or fix is available as the vendor has declined to service this vulnerability. The vendor recommends that customers mitigate risk by ensuring port 8080 is not exposed to the internet. Organizations should restrict external access to the affected service and consider network-level controls to prevent unauthorized access.