Stored Cross-Site Scripting Vulnerability in Advantech WISE-DeviceOn Server

CVE-2025-34264

What is CVE-2025-34264?

The Advantech WISE-DeviceOn Server prior to version 5.4 is susceptible to a stored cross-site scripting (XSS) vulnerability. This flaw occurs in the /rmm/v1/dog/{agentId} endpoint, where an attacker can manipulate the monitored process name during the configuration of Software Watchdog process rules. These names are saved in the settings array and later displayed in the Software Watchdog user interface without adequate HTML sanitization. As a result, any malicious script injected into the process name is executed in the browser context of users interacting with these affected rules, potentially leading to session hijacking or unauthorized actions performed on behalf of the victim.

References