PT-2025-49286 · Advantech · Wise-Deviceon Server

Alex Williams · Published 2025-12-05 · Updated 2025-12-05 · CVE-2025-34265

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Advantech WISE-DeviceOn Server versions prior to 5.4

Description The software contains a stored cross-site scripting (XSS) issue in the /rmm/v1/rule-engines API endpoint. An authenticated user creating or updating a rule for an agent can inject malicious script into the min, max, and unit rule fields. This script is then executed in the browser context of users viewing or interacting with the affected rule, potentially leading to session compromise and unauthorized actions. The issue occurs because the rule fields are stored and rendered without proper HTML sanitation.

Recommendations Update Advantech WISE-DeviceOn Server to version 5.4 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-34265

Affected Products

Wise-Deviceon Server

References · 8

• https://osv.dev/vulnerability/CVE-2025-34265 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34265 · Security Note
• https://twitter.com/CVEnew/status/1997000971432399137 · Twitter Post
• https://advcloudfiles.advantech.com/cms/2ca1b071-fd78-4d7f-8a2a-7b4537a95d19/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----DeviceOn-20251208-2.pdf · Patch, Vendor Advisory
• https://vulncheck.com/advisories/advantech-wise-deviceon-server-authenticated-stored-xss-via-rulesengine · Note
• https://advcloudfiles.advantech.com/cms/2ca1b071-fd78-4d7f-8a2a-7b4537a95d19/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----DeviceOn.pdf · Patch, Vendor Advisory
• https://t.me/CVEtracker/38941 · Telegram Post
• https://docs.deviceon.advantech.com/docs/resource · Note