CVE-2025-34260: Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via action/schedule
Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/action/schedule endpoint. When an authenticated user adds a schedule to an existing task, the schedule name is stored and later rendered in schedule listings without HTML sanitation. An attacker can inject malicious script into the schedule name, which is then executed in the browser context of users who view or interact with the affected schedule, potentially enabling session compromise and unauthorized actions as the victim.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Advantech WISE-DeviceOn Serverto a version that resolves this vulnerability.Fixed in 5.4 - Configuration
Ensure the schedule name submitted to the /rmm/v1/action/schedule endpoint is HTML-sanitized before being stored/rendered, since schedule names are stored and later rendered in schedule listings without HTML sanitation in versions prior to 5.4.
WISE-DeviceOn Server /rmm/v1/action/schedule HTML sanitization for stored schedule name = enable
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34260?
CVE-2025-34260 is classified as a medium severity vulnerability due to its potential impact on authenticated users.
How do I fix CVE-2025-34260?
To mitigate CVE-2025-34260, upgrade Advantech WISE-DeviceOn Server to version 5.4 or later.
What is the nature of CVE-2025-34260?
CVE-2025-34260 involves a stored cross-site scripting (XSS) vulnerability affecting the scheduling feature in the application.
Who is affected by CVE-2025-34260?
Authenticated users of Advantech WISE-DeviceOn Server versions prior to 5.4 are affected by CVE-2025-34260.
What endpoint is vulnerable in CVE-2025-34260?
The vulnerable endpoint in CVE-2025-34260 is /rmm/v1/action/schedule.