CVE-2025-34259: Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devicemap/building
Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devicemap/building endpoint. When an authenticated user creates a map entry, the name parameter is stored and later rendered in the map list UI without HTML sanitzation. An attacker can inject malicious script into the map entry name, which is then executed in the browser context of users who view or interact with the affected map entry, potentially enabling session compromise and unauthorized actions as the victim.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Advantech WISE-DeviceOn Serverto a version that resolves this vulnerability.Fixed in 5.4 - Configuration
Ensure the map entry name stored via /rmm/v1/devicemap/building is HTML-sanitized/encoded before being rendered in the map list UI so injected script is not executed in the browser.
/rmm/v1/devicemap/building endpoint (map entry name rendering) HTML sanitization for stored map entry name = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34259?
CVE-2025-34259 is classified as a stored cross-site scripting (XSS) vulnerability, which can significantly impact user sessions and lead to data leakage.
How do I fix CVE-2025-34259?
To fix CVE-2025-34259, upgrade to Advantech WISE-DeviceOn Server version 5.4 or later.
Who is affected by CVE-2025-34259?
CVE-2025-34259 affects users of Advantech WISE-DeviceOn Server versions prior to 5.4.
What components are involved in CVE-2025-34259?
CVE-2025-34259 affects the /rmm/v1/devicemap/building endpoint where device map entries are created.
What actions can be taken to mitigate CVE-2025-34259?
To mitigate CVE-2025-34259, ensure that user inputs are properly sanitized before rendering on the web interface.