PT-2025-49277 · Advantech · Wise-Deviceon Server

Alex Williams · Published 2025-12-05 · Updated 2026-01-01 · CVE-2025-34256

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Advantech WISE-DeviceOn Server versions prior to 5.4

Description The software uses a static HS512 HMAC secret for signing EIRMMToken JWTs across all installations. This allows a remote unauthenticated attacker to generate forged JWTs containing a valid email claim, enabling impersonation of any DeviceOn account, including the root super admin. Successful exploitation grants full administrative control of the DeviceOn instance and allows code execution on managed agents through the software’s remote management features. The API endpoint is vulnerable to accepting forged JWTs. The vulnerable parameter is the email claim within the JWT.

Recommendations Versions prior to 5.4 should be updated. Restrict access to the software as a temporary mitigation.

Exploit

Fix

Weakness Enumeration

CWE-321

Related Identifiers

CVE-2025-34256

Affected Products

Wise-Deviceon Server

References · 13

• 🔥 https://pellera.com/blog/advantech-wise-deviceon-cve-2025-34256-vulnerability · Exploit
• https://osv.dev/vulnerability/CVE-2025-34256 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34256 · Security Note
• https://t.me/cveNotify/146109 · Telegram Post
• https://vulncheck.com/advisories/advantech-wise-deviceon-server-hardcoded-jwt-key-authentication-bypass · Note
• https://advcloudfiles.advantech.com/cms/2ca1b071-fd78-4d7f-8a2a-7b4537a95d19/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----DeviceOn-20251208-2.pdf · Patch, Vendor Advisory
• https://twitter.com/offseq/status/1997139513743720507 · Twitter Post
• https://twitter.com/CCBalert/status/1998090427208024141 · Twitter Post
• https://t.me/poxek/5747 · Telegram Post
• https://advcloudfiles.advantech.com/cms/2ca1b071-fd78-4d7f-8a2a-7b4537a95d19/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----DeviceOn.pdf · Patch, Vendor Advisory
• https://docs.deviceon.advantech.com/docs/resource · Note
• https://twitter.com/SecReportCVE/status/2006820787416600919 · Twitter Post
• https://twitter.com/CVEnew/status/1997000970446811282 · Twitter Post