Stored Cross-Site Scripting Vulnerability in Advantech WISE-DeviceOn Server

CVE-2025-34264

What is CVE-2025-34264?

The Advantech WISE-DeviceOn Server prior to version 5.4 is susceptible to a stored cross-site scripting (XSS) vulnerability. This flaw occurs in the /rmm/v1/dog/{agentId} endpoint, where an attacker can manipulate the monitored process name during the configuration of Software Watchdog process rules. These names are saved in the settings array and later displayed in the Software Watchdog user interface without adequate HTML sanitization. As a result, any malicious script injected into the process name is executed in the browser context of users interacting with these affected rules, potentially leading to session hijacking or unauthorized actions performed on behalf of the victim.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References