PT-2025-49281 · Advantech · Wise-Deviceon Server

Alex Williams · CVE-2025-34260 · Publicado 2025-12-05 · Atualizado 2025-12-05

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Advantech WISE-DeviceOn Server versions prior to 5.4

Description The software contains a stored cross-site scripting (XSS) issue in the /rmm/v1/action/schedule API endpoint. An attacker can inject malicious script into the schedule name when an authenticated user adds a schedule to an existing task. This script is then executed in the browser context of users who view or interact with the affected schedule, potentially enabling session compromise and unauthorized actions as the victim, due to a lack of HTML sanitation when rendering schedule listings. The vulnerable parameter is the schedule name.

Recommendations Update to version 5.4 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-34260

Produtos afetados

Wise-Deviceon Server

Referências · 7

• https://docs.deviceon.advantech.com/docs/resource · Nota
• https://osv.dev/vulnerability/CVE-2025-34260 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1997000983226748979 · Publicação no Twitter
• https://advcloudfiles.advantech.com/cms/2ca1b071-fd78-4d7f-8a2a-7b4537a95d19/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----DeviceOn.pdf · Correção, Aviso do Fabricante
• https://advcloudfiles.advantech.com/cms/2ca1b071-fd78-4d7f-8a2a-7b4537a95d19/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----DeviceOn-20251208-2.pdf · Correção, Aviso do Fabricante
• https://vulncheck.com/advisories/advantech-wise-deviceon-server-authenticated-stored-xss-via-action-schedule · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-34260 · Nota de Segurança