CVE-2025-34262: Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devices/name/{agent_id}
Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devices/name/{agentid} endpoint. When an authenticated user renames a device, the newname value is stored and later rendered in device listings or detail views without proper HTML sanitation. An attacker can inject malicious script into the device name, which is then executed in the browser context of users who view or interact with the affected device, potentially enabling session compromise and unauthorized actions as the victim.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Advantech WISE-DeviceOn Serverto a version that resolves this vulnerability.Fixed in 5.4 - Configuration
Ensure the stored device name (new_name) is properly HTML-encoded/sanitized when rendered in the device listings and detail views for the /rmm/v1/devices/name/{agent_id} endpoint to prevent stored XSS execution.
WISE-DeviceOn Server HTML sanitation for stored device name (new_name rendered in /rmm/v1/devices/name/{agent_id} listings/detail views) = Enable proper HTML output encoding/sanitization before rendering
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34262?
CVE-2025-34262 has a severity rating that indicates a moderate risk due to its potential for stored cross-site scripting (XSS) attacks.
How do I fix CVE-2025-34262?
To fix CVE-2025-34262, update Advantech WISE-DeviceOn Server to version 5.4 or later.
What type of vulnerability is CVE-2025-34262?
CVE-2025-34262 is a stored cross-site scripting (XSS) vulnerability.
Where is CVE-2025-34262 found within the software?
CVE-2025-34262 is found in the /rmm/v1/devices/name/{agent_id} endpoint of Advantech WISE-DeviceOn Server.
Who is affected by CVE-2025-34262?
Authenticated users of Advantech WISE-DeviceOn Server versions prior to 5.4 are affected by CVE-2025-34262.