CVE-2025-34257: Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via action/defined
Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/action/defined endpoint. When an authenticated user creates a task, the definedname value is stored and later rendered in the Overview page without HTML sanitization. An attacker can inject malicious script into definedname, which is then executed in the browser context of users who view the affected task, potentially enabling session compromise and unauthorized actions as the victim.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Advantech WISE-DeviceOn Serverto a version that resolves this vulnerability.Fixed in 5.4 - Compensating control
Mitigate by preventing authenticated users from viewing or using the /rmm/v1/action/defined endpoint or the task Overview page until the server is upgraded to a version including 5.4, to reduce exposure to stored XSS from defined_name.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34257?
CVE-2025-34257 is classified as a medium severity stored cross-site scripting (XSS) vulnerability.
How do I fix CVE-2025-34257?
To fix CVE-2025-34257, you should upgrade to Advantech WISE-DeviceOn Server version 5.4 or later.
What type of vulnerability is CVE-2025-34257?
CVE-2025-34257 is a stored cross-site scripting (XSS) vulnerability affecting the defined endpoint.
Which versions of Advantech WISE-DeviceOn Server are affected by CVE-2025-34257?
CVE-2025-34257 affects Advantech WISE-DeviceOn Server versions prior to 5.4.
Can CVE-2025-34257 be exploited by authenticated users?
Yes, CVE-2025-34257 can be exploited by authenticated users when creating tasks that include unvalidated input.