CVE-2025-34516 is a critical flaw (CVSS 9.8) in the Ilevia EVE X1 Server. Firmware through 4.7.18.0.eden uses default credentials that let an unauthenticated attacker obtain remote access. Ilevia has declined to service it, so there is no vendor fix to install. The vendor's advice is to keep port 8080 off the internet.
What's affected
The CVE record lists Ilevia EVE X1 Server firmware versions up to and including 4.7.18.0.eden. The record describes default credentials that give an unauthenticated attacker remote access.
The record states that Ilevia has declined to service this vulnerability. That means you should not wait for a patched firmware. I found no fixed version in the record or the pages I read, so if you need to be sure, ask Ilevia directly and check the vendor site at ilevia.com.
How to check if you're exposed
Start with the firmware version in the EVE X1 Server administration interface and compare it with 4.7.18.0.eden. If it is that version or older, the device is in scope.
Then check reachability, because that is what the vendor's advice is about. From a machine outside your network, test whether port 8080 on the device's public address is open. Look at your router or firewall for port forwards that map to the server, and check any cloud or hosting firewall in front of it. A search engine for internet facing devices can also show whether your address exposes it, if you use one you trust.
Also check who inside your network can reach it. Building automation gear often sits on a flat network with desktops and guest Wi-Fi.
What to do now
- Identify every EVE X1 Server you run and record its firmware version.
- Block port 8080 from the internet at the firewall, and remove any port forward to the device.
- If the interface lets you change account passwords, change any credentials that came with the device. I could not confirm from the sources whether the credentials can be changed, so test this on a spare unit.
- Limit internal access to a small management network, using VLANs or firewall rules.
- Put remote access behind a VPN with strong authentication, rather than exposing the device.
- Monitor the device and its network segment for unexpected logins or outbound connections.
- Plan a replacement if the product matters to you, since the vendor will not fix this.
Why it matters
The class is use of default credentials (CWE-1392). A device ships with a known login, and anyone who knows it can use it. Default accounts are among the easiest weaknesses to automate, because the same login works on every unit that has not been changed.
With no patch coming, the control that matters is network isolation. Treat the device as one that cannot be trusted with direct exposure, and wrap it in firewall rules until it can be retired. The record does not say this CVE is exploited, and it is not on the CISA Known Exploited Vulnerabilities list, but a public write-up and an unfixed flaw make it easy to attempt.
Note that this family of issues covers several CVEs for the same firmware, so closing the network path helps with all of them at once.
Quick check
Is there a patch for CVE-2025-34516?
The record says Ilevia has declined to service the vulnerability. Rely on network controls, and ask the vendor if you need confirmation.
What is the single most useful step?
Make sure port 8080 is not reachable from the internet, and limit internal access to trusted management hosts.
Sources
Last reviewed: 18 October 2026.
