CVE-2025-34266: Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via plugin-config/addins/menus
Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/plugin-config/addins/menus endpoint. When an authenticated user adds or edits an AddIns menu entry, the label and path values are stored in plugin configuration data and later rendered in the AddIns UI without proper HTML sanitation. An attacker can inject malicious script into either field, which is then executed in the browser context of users who view or interact with the affected AddIns entry, potentially enabling session compromise and unauthorized actions as the victim.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Advantech WISE-DeviceOn Serverto a version that resolves this vulnerability.Fixed in 5.4 - Configuration
Ensure the stored AddIns menu fields (specifically the label and path values saved from the authenticated AddIns add/edit flow to plugin configuration data) are properly HTML-sanitized/escaped before being rendered by the AddIns UI for the /rmm/v1/plugin-config/addins/menus endpoint.
Advantech WISE-DeviceOn Server (AddIns UI for /rmm/v1/plugin-config/addins/menus) HTML sanitation for stored AddIns menu fields = properly sanitize/escape label and path values before rendering in the AddIns UI
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34266?
CVE-2025-34266 is classified as a medium severity vulnerability.
How do I fix CVE-2025-34266?
To fix CVE-2025-34266, upgrade to Advantech WISE-DeviceOn Server version 5.4 or later.
What type of vulnerability is CVE-2025-34266?
CVE-2025-34266 is a stored cross-site scripting (XSS) vulnerability.
What is affected by CVE-2025-34266?
CVE-2025-34266 affects Advantech WISE-DeviceOn Server versions prior to 5.4.
How does CVE-2025-34266 exploit user input?
CVE-2025-34266 exploits user input by allowing an attacker to inject malicious scripts through the plugin configuration menus.