CVE-2025-34265: Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via rule-engines
Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/rule-engines endpoint. When an authenticated user creates or updates a rule for an agent, the rule fields min, max, and unit are stored and later rendered in rule listings or detail views without proper HTML sanitation. An attacker can inject malicious script into one or more of these fields, which is then executed in the browser context of users who view or interact with the affected rule, potentially enabling session compromise and unauthorized actions as the victim.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Advantech WISE-DeviceOn Serverto a version that resolves this vulnerability.Fixed in 5.4 - Configuration
Ensure stored XSS protections are applied to the rendered rule fields min, max, and unit in rule listings and detail views (proper HTML sanitization/escaping) so injected scripts are not executed in user browsers.
WISE-DeviceOn Server (/rmm/v1/rule-engines endpoint) HTML sanitization/escaping for stored rule fields = enabled - Compensating control
Limit access to the /rmm/v1/rule-engines endpoint so only authorized users/agents can create or update rules, reducing the ability to inject malicious content.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34265?
CVE-2025-34265 is classified as a medium severity stored cross-site scripting (XSS) vulnerability.
How do I fix CVE-2025-34265?
To fix CVE-2025-34265, upgrade the Advantech WISE-DeviceOn Server to version 5.4 or later.
Who is affected by CVE-2025-34265?
CVE-2025-34265 affects users of Advantech WISE-DeviceOn Server versions prior to 5.4.
What are the potential impacts of CVE-2025-34265?
The potential impacts of CVE-2025-34265 include unauthorized execution of scripts in the context of the user’s session.
Can CVE-2025-34265 be exploited remotely?
CVE-2025-34265 requires authentication, so it can only be exploited by authenticated users with access to the system.