PT-2025-49280 · Advantech · Wise-Deviceon Server

Alex Williams · Published 2025-12-05 · Updated 2025-12-05 · CVE-2025-34259

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Advantech WISE-DeviceOn Server versions prior to 5.4

Description The software contains a stored cross-site scripting (XSS) issue in the /rmm/v1/devicemap/building API endpoint. An authenticated user creating a map entry allows an attacker to inject malicious script into the name parameter. This script is then executed in the browser context of users viewing or interacting with the affected map entry, potentially leading to session compromise and unauthorized actions. The vulnerable parameter is name.

Recommendations Update to version 5.4 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-34259

Affected Products

Wise-Deviceon Server

References · 7

• https://osv.dev/vulnerability/CVE-2025-34259 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34259 · Security Note
• https://advcloudfiles.advantech.com/cms/2ca1b071-fd78-4d7f-8a2a-7b4537a95d19/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----DeviceOn.pdf · Patch, Vendor Advisory
• https://advcloudfiles.advantech.com/cms/2ca1b071-fd78-4d7f-8a2a-7b4537a95d19/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----DeviceOn-20251208-2.pdf · Patch, Vendor Advisory
• https://twitter.com/CVEnew/status/1997000981007987049 · Twitter Post
• https://vulncheck.com/advisories/advantech-wise-deviceon-server-authenticated-stored-xss-via-devicemap-building · Note
• https://docs.deviceon.advantech.com/docs/resource · Note