Critical XSS Vulnerability Discovered in Advantech WISE-DeviceOn Server (CVE-2025-34265)

Overview

A significant security vulnerability, identified as CVE-2025-34265, has been discovered in Advantech WISE-DeviceOn Server. This vulnerability affects versions prior to 5.4 and is classified as a stored cross-site scripting (XSS) issue.

Technical Details

The vulnerability resides in the /rmm/v1/rule-engines endpoint. Specifically, when an authenticated user creates or updates a rule for an agent, the fields ‘min’, ‘max’, and ‘unit’ are stored without proper HTML sanitization. These unsanitized fields are then rendered in rule listings or detail views.

An attacker can exploit this by injecting malicious JavaScript code into these fields. When a user views or interacts with the affected rule, the injected script executes in their browser context. This could lead to session compromise, unauthorized actions performed on behalf of the victim, and other malicious activities.

Example scenario:

      Rule Name:  My Rule
      Min:       <script>alert('XSS Vulnerability!');</script>
      Max:       100
      Unit:      °C
    

When another user views this rule, the JavaScript code will execute in their browser.

CVSS Analysis

Currently, the CVSS score and severity for CVE-2025-34265 are listed as N/A. However, given the nature of stored XSS vulnerabilities and the potential for significant impact, it’s crucial to address this issue promptly.

Note: While a CVSS score is currently unavailable, XSS vulnerabilities are generally considered high-risk due to their potential for widespread impact and exploitation.

Possible Impact

The successful exploitation of this XSS vulnerability can have serious consequences:

• Session Hijacking: An attacker could steal a user’s session cookie and gain unauthorized access to their account.
• Account Takeover: By stealing session cookies or performing other malicious actions, an attacker could completely take over a user’s account.
• Data Theft: An attacker could potentially steal sensitive data stored within the application.
• Malware Distribution: The injected script could be used to redirect users to malicious websites or to download malware.
• Defacement: An attacker could modify the appearance of the application, causing damage to the organization’s reputation.

Mitigation and Patch Steps

Advantech has released a patch to address this vulnerability. It is highly recommended to upgrade your WISE-DeviceOn Server to version 5.4 or later as soon as possible.

1. Upgrade to Version 5.4 or Later: Download and install the latest version of WISE-DeviceOn Server from the official Advantech website. Refer to the documentation for detailed upgrade instructions.
2. Input Validation: (If a patch isn’t immediately feasible) Implement strict input validation on the ‘min’, ‘max’, and ‘unit’ fields in the /rmm/v1/rule-engines endpoint. Sanitize all user input to remove or escape any potentially malicious characters (e.g., HTML tags, JavaScript code). This is a temporary workaround and should be replaced by the official patch.
3. Regular Security Audits: Conduct regular security audits of your WISE-DeviceOn Server installation to identify and address any potential vulnerabilities.

References

• Advantech Security Advisory: SECURITY-ADVISORY—-DeviceOn.pdf
• Advantech WISE-DeviceOn Documentation: docs.deviceon.advantech.com
• Vulncheck Advisory: vulncheck.com