Stored Cross-Site Scripting Vulnerability in Advantech WISE-DeviceOn Server

CVE-2025-34259

What is CVE-2025-34259?

Advantech WISE-DeviceOn Server versions prior to 5.4 are susceptible to a stored Cross-Site Scripting (XSS) vulnerability in the /rmm/v1/devicemap/building endpoint. When an authenticated user creates an entry for a map, the input name parameter is saved and later displayed in the UI without adequate HTML sanitization. This oversight allows an attacker to input a malicious script into the map entry name, which is then executed in the browser of users who interact with the compromised entry. Such an exploit could lead to session hijacking and unauthorized actions within the application.

References