PT-2025-49282 · Advantech · Wise-Deviceon Server

Alex Williams · Published 2025-12-05 · Updated 2025-12-05 · CVE-2025-34261

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Advantech WISE-DeviceOn Server versions prior to 5.4

Description The software contains a stored cross-site scripting (XSS) issue in the /rmm/v1/devicegroups/ API endpoint. An attacker can inject malicious script into the name and description fields when creating a device group. This script is then executed in the browser of users who view the affected device group, potentially leading to session compromise and unauthorized actions. The issue occurs because the software does not properly sanitize HTML when storing and rendering these values in device group listings.

Recommendations Update to version 5.4 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-34261

Affected Products

Wise-Deviceon Server

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-34261 · Security Note
• https://osv.dev/vulnerability/CVE-2025-34261 · Vendor Advisory
• https://advcloudfiles.advantech.com/cms/2ca1b071-fd78-4d7f-8a2a-7b4537a95d19/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----DeviceOn.pdf · Patch, Vendor Advisory
• https://twitter.com/CVEnew/status/1997000982299812227 · Twitter Post
• https://advcloudfiles.advantech.com/cms/2ca1b071-fd78-4d7f-8a2a-7b4537a95d19/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----DeviceOn-20251208-2.pdf · Patch, Vendor Advisory
• https://vulncheck.com/advisories/advantech-wise-deviceon-server-authenticated-stored-xss-via-devicegroups · Note
• https://docs.deviceon.advantech.com/docs/resource · Note