PT-2025-49285 · Advantech · Wise-Deviceon Server

Alex Williams · Published 2025-12-05 · Updated 2025-12-05 · CVE-2025-34264

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Advantech WISE-DeviceOn Server versions prior to 5.4

Description The software contains a stored cross-site scripting (XSS) issue in the /rmm/v1/dog/{agentId} API endpoint. An authenticated user adding or editing Software Watchdog process rules for an agent allows an attacker to inject malicious script into the process name. This script is then executed in the browser context of users viewing or interacting with the affected rules, potentially leading to session compromise and unauthorized actions. The vulnerable parameter is the monitored process name, which is stored in the settings array and rendered in the Software Watchdog UI without proper HTML sanitation.

Recommendations Update to version 5.4 or later. As a temporary workaround, sanitize all user-supplied input for the monitored process name before storing it in the settings array.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-34264

Affected Products

Wise-Deviceon Server

References · 8

• https://osv.dev/vulnerability/CVE-2025-34264 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34264 · Security Note
• https://vulncheck.com/advisories/advantech-wise-deviceon-server-authenticated-stored-xss-via-dog-agentid · Note
• https://twitter.com/CVEnew/status/1997000977249865757 · Twitter Post
• https://t.me/CVEtracker/38940 · Telegram Post
• https://advcloudfiles.advantech.com/cms/2ca1b071-fd78-4d7f-8a2a-7b4537a95d19/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----DeviceOn.pdf · Patch, Vendor Advisory
• https://advcloudfiles.advantech.com/cms/2ca1b071-fd78-4d7f-8a2a-7b4537a95d19/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----DeviceOn-20251208-2.pdf · Patch, Vendor Advisory
• https://docs.deviceon.advantech.com/docs/resource · Note