advantech WISE-DeviceOn Server vulnerabilities

Latest advantech WISE-DeviceOn Server CVEs

Newest publication first

1. CVE-2025-34256 Advantech WISE-DeviceOn Server < 5.4 Hard-coded JWT Key Authentication Bypass

   Published 2025-12-05

   Critical·CVSS 10.0 EPSS 0.74%

   Advantech WISE-DeviceOn Server versions prior to 5.4 contain a hard-coded cryptographic key vulnerability. The product uses a static HS512 HMAC secret for signing EIRMMToken JWTs across all installations. The server accepts forged JWTs that need only contain a valid email claim,...

2. CVE-2025-34265 Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via rule-engines

   Published 2025-12-05

   Medium·CVSS 5.1 EPSS 0.22%

   Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/rule-engines endpoint. When an authenticated user creates or updates a rule for an agent, the rule fields min, max, and unit are stored and later rendered...

3. CVE-2025-34263 Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via plugin-config/dashboards/menus

   Published 2025-12-05

   Medium·CVSS 5.1 EPSS 0.22%

   Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/plugin-config/dashboards/menus endpoint. When an authenticated user adds or edits a dashboard entry, the label and path values are stored in plugin config...

4. CVE-2025-34266 Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via plugin-config/addins/menus

   Published 2025-12-05

   Medium·CVSS 5.1 EPSS 0.23%

   Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/plugin-config/addins/menus endpoint. When an authenticated user adds or edits an AddIns menu entry, the label and path values are stored in plugin configu...

5. CVE-2025-34264 Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via dog/{agentId}

   Published 2025-12-05

   Medium·CVSS 5.1 EPSS 0.22%

   Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/dog/{agentId} endpoint. When an authenticated user adds or edits Software Watchdog process rules for an agent, the monitored process name is stored in the...

6. CVE-2025-34262 Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devices/name/{agent_id}

   Published 2025-12-05

   Medium·CVSS 5.1 EPSS 0.23%

   Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devices/name/{agent_id} endpoint. When an authenticated user renames a device, the new_name value is stored and later rendered in device listings or detai...

7. CVE-2025-34258 Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devicemap/plan

   Published 2025-12-05

   Medium·CVSS 5.1 EPSS 0.23%

   Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devicemap/plan endpoint. When an authenticated user adds an area to a map entry, the name parameter is stored and later rendered in the map list without H...

8. CVE-2025-34259 Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devicemap/building

   Published 2025-12-05

   Medium·CVSS 5.1 EPSS 0.28%

   Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devicemap/building endpoint. When an authenticated user creates a map entry, the name parameter is stored and later rendered in the map list UI without HT...

9. CVE-2025-34261 Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devicegroups/

   Published 2025-12-05

   Medium·CVSS 5.1 EPSS 0.28%

   Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devicegroups/ endpoint. When an authenticated user creates a device group, the name and description values are stored and later rendered in device group l...

10. CVE-2025-34260 Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via action/schedule

    Published 2025-12-05

    Medium·CVSS 5.1 EPSS 0.27%

    Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/action/schedule endpoint. When an authenticated user adds a schedule to an existing task, the schedule name is stored and later rendered in schedule listi...

11. CVE-2025-34257 Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via action/defined

    Published 2025-12-05

    Medium·CVSS 5.1 EPSS 0.28%

    Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/action/defined endpoint. When an authenticated user creates a task, the defined_name value is stored and later rendered in the Overview page without HTML...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.