PT-2025-49278 · Advantech · Wise-Deviceon Server

Alex Williams · Published 2025-12-05 · Updated 2025-12-17 · CVE-2025-34257

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Advantech WISE-DeviceOn Server versions prior to 5.4

Description The software contains a stored cross-site scripting (XSS) issue in the /rmm/v1/action/defined API endpoint. An attacker can inject malicious script into the defined name variable when an authenticated user creates a task. This script is then executed in the browser context of users who view the affected task, potentially leading to session compromise and unauthorized actions. The issue occurs because the defined name value is stored and rendered in the Overview page without proper HTML sanitization.

Recommendations Update to version 5.4 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-34257

Affected Products

Wise-Deviceon Server

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-34257 · Security Note
• https://osv.dev/vulnerability/CVE-2025-34257 · Vendor Advisory
• https://t.me/cveNotify/146110 · Telegram Post
• https://vulncheck.com/advisories/advantech-wise-deviceon-server-authenticated-stored-xss-via-action-defined · Note
• https://twitter.com/CVEnew/status/1997000984099201504 · Twitter Post
• https://advcloudfiles.advantech.com/cms/2ca1b071-fd78-4d7f-8a2a-7b4537a95d19/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----DeviceOn.pdf · Patch, Vendor Advisory
• https://advcloudfiles.advantech.com/cms/2ca1b071-fd78-4d7f-8a2a-7b4537a95d19/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----DeviceOn-20251208-2.pdf · Patch, Vendor Advisory
• https://docs.deviceon.advantech.com/docs/resource · Note