What’s Vulnerable › Vulnerabilities

CVE-2025-64302: Advantech DeviceOn/iEdge Cross-site Scripting

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-06 · updated 2026-06-17
• Weakness: CWE-79

Description

Insufficient input sanitization in the dashboard label or path can allow an attacker to trigger a device error causing information disclosure or data manipulation.

Affected products

• Advantech Deviceon/Iedge: through 2.0.2

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-310-01.json
• https://www.advantech.com/emt/contact
• https://www.cisa.gov/news-events/ics-advisories/icsa-25-310-01

Get alerted when CVE-2025-64302 or the next vulnerability affects your stack