PT-2025-49287 · Advantech · Wise-Deviceon Server

Alex Williams · Published 2025-12-05 · Updated 2025-12-05 · CVE-2025-34266

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Advantech WISE-DeviceOn Server versions prior to 5.4

Description The software contains a stored cross-site scripting (XSS) issue in the /rmm/v1/plugin-config/addins/menus API endpoint. An authenticated user adding or editing an AddIns menu entry can inject malicious script into the label and path values. These values are stored in plugin configuration data and rendered in the AddIns UI without proper HTML sanitation. This allows an attacker to execute script in the browser context of users viewing or interacting with the affected AddIns entry, potentially leading to session compromise and unauthorized actions.

Recommendations Update to version 5.4 or later. As a temporary workaround, carefully sanitize all input to the label and path parameters when adding or editing AddIns menu entries.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-34266

Affected Products

Wise-Deviceon Server

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-34266 · Security Note
• https://osv.dev/vulnerability/CVE-2025-34266 · Vendor Advisory
• https://twitter.com/CVEnew/status/1997000976255918220 · Twitter Post
• https://t.me/CVEtracker/38942 · Telegram Post
• https://advcloudfiles.advantech.com/cms/2ca1b071-fd78-4d7f-8a2a-7b4537a95d19/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----DeviceOn.pdf · Patch, Vendor Advisory
• https://advcloudfiles.advantech.com/cms/2ca1b071-fd78-4d7f-8a2a-7b4537a95d19/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----DeviceOn-20251208-2.pdf · Patch, Vendor Advisory
• https://vulncheck.com/advisories/advantech-wise-deviceon-server-authenticated-stored-xss-via-pluginconfig-addins-menus · Note
• https://docs.deviceon.advantech.com/docs/resource · Note