PT-2025-49283 · Advantech · Wise-Deviceon Server

Alex Williams · Published 2025-12-05 · Updated 2025-12-05 · CVE-2025-34262

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Advantech WISE-DeviceOn Server versions prior to 5.4

Description The software contains a stored cross-site scripting (XSS) issue in the /rmm/v1/devices/name/{agent id} API endpoint. An authenticated user renaming a device allows for the injection of malicious script via the new name value. This script is executed in the browser of users viewing or interacting with the affected device, potentially leading to session compromise and unauthorized actions.

Recommendations Update to a version prior to 5.4.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-34262

Affected Products

Wise-Deviceon Server

References · 7

• https://osv.dev/vulnerability/CVE-2025-34262 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34262 · Security Note
• https://twitter.com/CVEnew/status/1997000978181099561 · Twitter Post
• https://advcloudfiles.advantech.com/cms/2ca1b071-fd78-4d7f-8a2a-7b4537a95d19/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----DeviceOn.pdf · Patch, Vendor Advisory
• https://advcloudfiles.advantech.com/cms/2ca1b071-fd78-4d7f-8a2a-7b4537a95d19/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----DeviceOn-20251208-2.pdf · Patch, Vendor Advisory
• https://vulncheck.com/advisories/advantech-wise-deviceon-server-authenticated-stored-xss-via-devices-name-agentid · Note
• https://docs.deviceon.advantech.com/docs/resource · Note