Stored Cross-Site Scripting Vulnerability in Advantech WISE-DeviceOn Server

CVE-2025-34262

What is CVE-2025-34262?

Advantech WISE-DeviceOn Server prior to version 5.4 is susceptible to a stored cross-site scripting vulnerability. This occurs in the /rmm/v1/devices/name/{agent_id} endpoint, where an authenticated user can rename a device. The new device name is stored and later rendered in views that lack proper HTML sanitation. As a result, an attacker can inject a malicious script within the device name. When other users interact with the affected views, this script executes in their browsers, potentially allowing the attacker to compromise user sessions and perform unauthorized actions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References