What’s Vulnerable › Vulnerabilities

CVE-2025-34265: Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via rule-engines

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-05 · updated 2026-10-18
• Weakness: CWE-79

Description

Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/rule-engines endpoint. When an authenticated user creates or updates a rule for an agent, the rule fields min, max, and unit are stored and later rendered in rule listings or detail views without proper HTML sanitation. An attacker can inject malicious script into one or more of these fields, which is then executed in the browser context of users who view or interact with the affected rule, potentially enabling session compromise and unauthorized actions as the victim.

Affected products

• Advantech Co., Ltd. WISE-DeviceOn Server: before 5.4 — fixed in 5.4

How to fix

Upgrade to a fixed version: Advantech Co., Ltd. WISE-DeviceOn Server 5.4. Check the vendor advisory for mitigations.

References

• https://advcloudfiles.advantech.com/cms/2ca1b071-fd78-4d7f-8a2a-7b4537a95d19/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----DeviceOn-20251208-2.pdf
• https://docs.deviceon.advantech.com/docs/resource/
• https://www.vulncheck.com/advisories/advantech-wise-deviceon-server-authenticated-stored-xss-via-rulesengine

Get alerted when CVE-2025-34265 or the next vulnerability affects your stack