CVE-2025-34513 is a critical flaw (CVSS 9.8) in the Ilevia EVE X1 Server. Firmware through 4.7.18.0.eden has an OS command injection in a script named mbus_build_from_csv.php that lets an unauthenticated attacker run code. Ilevia has declined to service it, so there is no vendor fix to install. The vendor's advice is to keep port 8080 off the internet.
What's affected
The CVE record lists Ilevia EVE X1 Server firmware versions up to and including 4.7.18.0.eden. The affected code is the script mbus_build_from_csv.php, and the attacker needs no login.
The record states that Ilevia has declined to service this vulnerability. That means you should not wait for a patched firmware. I found no fixed version in the record or the pages I read, so if you need to be sure, ask Ilevia directly and check the vendor site at ilevia.com.
How to check if you're exposed
Start with the firmware version in the EVE X1 Server administration interface and compare it with 4.7.18.0.eden. If it is that version or older, the device is in scope.
Then check reachability, because that is what the vendor's advice is about. From a machine outside your network, test whether port 8080 on the device's public address is open. Look at your router or firewall for port forwards that map to the server, and check any cloud or hosting firewall in front of it. A search engine for internet facing devices can also show whether your address exposes it, if you use one you trust.
Also check who inside your network can reach it. Building automation gear often sits on a flat network with desktops and guest Wi-Fi.
What to do now
- Identify every EVE X1 Server you run and record its firmware version.
- Block port 8080 from the internet at the firewall, and remove any port forward to the device.
- Limit internal access to a small management network, using VLANs or firewall rules.
- Put remote access behind a VPN with strong authentication, rather than exposing the device.
- Monitor the device and its network segment for unexpected logins or outbound connections.
- Plan a replacement if the product matters to you, since the vendor will not fix this.
Why it matters
The class is OS command injection (CWE-78). Data supplied by a caller reaches a system command without being neutralised, so the caller can add commands of their own. Because the record says no authentication is needed, anyone who can reach the web service can attempt it.
With no patch coming, the control that matters is network isolation. Treat the device as one that cannot be trusted with direct exposure, and wrap it in firewall rules until it can be retired. The record does not say this CVE is exploited, and it is not on the CISA Known Exploited Vulnerabilities list, but a public write-up and an unfixed flaw make it easy to attempt.
Note that this family of issues covers several CVEs for the same firmware, so closing the network path helps with all of them at once.
Quick check
Is there a patch for CVE-2025-34513?
The record says Ilevia has declined to service the vulnerability. Rely on network controls, and ask the vendor if you need confirmation.
What is the single most useful step?
Make sure port 8080 is not reachable from the internet, and limit internal access to trusted management hosts.
Sources
Last reviewed: 18 October 2026.
