What’s Vulnerable › Vulnerabilities

CVE-2025-34261: Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devicegroups/

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-05 · updated 2026-10-18
• Weakness: CWE-79

Description

Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devicegroups/ endpoint. When an authenticated user creates a device group, the name and description values are stored and later rendered in device group listings without proper HTML sanitation. An attacker can inject malicious script into either field, which is then executed in the browser context of users who view or interact with the affected device group, potentially enabling session compromise and unauthorized actions as the victim.

Affected products

• Advantech Co., Ltd. WISE-DeviceOn Server: before 5.4 — fixed in 5.4

How to fix

Upgrade to a fixed version: Advantech Co., Ltd. WISE-DeviceOn Server 5.4. Check the vendor advisory for mitigations.

References

• https://advcloudfiles.advantech.com/cms/2ca1b071-fd78-4d7f-8a2a-7b4537a95d19/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----DeviceOn-20251208-2.pdf
• https://docs.deviceon.advantech.com/docs/resource/
• https://www.vulncheck.com/advisories/advantech-wise-deviceon-server-authenticated-stored-xss-via-devicegroups

Get alerted when CVE-2025-34261 or the next vulnerability affects your stack