Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/action/defined endpoint. When an authenticated user creates a task, the defined_name value is stored and later rendered in the Overview page without HTML sanitization. An attacker can inject malicious script into defined_name, which is then executed in the browser context of users who view the affected task, potentially enabling session compromise and unauthorized actions as the victim.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Advantech |
|
No data.
No data.
References
History
Fri, 05 Dec 2025 21:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Advantech
Advantech wise-deviceon |
|
| Vendors & Products |
Advantech
Advantech wise-deviceon |
Fri, 05 Dec 2025 17:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/action/defined endpoint. When an authenticated user creates a task, the defined_name value is stored and later rendered in the Overview page without HTML sanitization. An attacker can inject malicious script into defined_name, which is then executed in the browser context of users who view the affected task, potentially enabling session compromise and unauthorized actions as the victim. | |
| Title | Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via action/defined | |
| Weaknesses | CWE-79 | |
| References |
|
|
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2025-12-05T17:15:24.912Z
Reserved: 2025-04-15T19:15:22.578Z
Link: CVE-2025-34257
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-12-05T18:15:55.220
Modified: 2025-12-05T18:15:55.220
Link: CVE-2025-34257
Redhat
No data.