CVE-2025-34259

Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devicemap/building endpoint. When an authenticated user creates a map entry, the name parameter is stored and later rendered in the map list UI without HTML sanitzation. An attacker can inject malicious script into the map entry name, which is then executed in the browser context of users who view or interact with the affected map entry, potentially enabling session compromise and unauthorized actions as the victim.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://advcloudfiles.advantech.com/cms/2ca1b071-fd78-4d7f-8a2a-7b4537a95d19/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----DeviceOn-20251208-2.pdf
https://docs.deviceon.advantech.com/docs/resource/	Product
https://www.vulncheck.com/advisories/advantech-wise-deviceon-server-authenticated-stored-xss-via-devicemap-building	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:advantech:wise-deviceon_server:*:*:*:*:*:*:*:*

History

18 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) Advantech WISE-DeviceOn Server versiones anteriores a 5.4 contiene una vulnerabilidad de cross?site scripting (XSS) almacenada en el endpoint **/rmm/v1/devicemap/building. Cuando un usuario autenticado crea una entrada de mapa, el parámetro name se almacena y luego se muestra en la interfaz de lista de mapas sin sanitización HTML. Un atacante puede inyectar script malicioso en el nombre de la entrada de mapa, que se ejecuta en el contexto del navegador de los usuarios que visualizan o interactúan con la entrada de mapa afectada, lo que potencialmente permite la compromisión de sesión y acciones no autorizadas como la víctima.

Information

Published : 2025-12-05 18:15

Updated : 2026-10-18 14:10

NVD link : CVE-2025-34259

Mitre link : CVE-2025-34259

CVE.ORG link : CVE-2025-34259

JSON object : View

Products Affected

advantech

wise-deviceon_server

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-34259", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-34259", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-12T17:17:48.938987Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Advantech Co., Ltd.", "product": "WISE-DeviceOn Server", "versions": [{"status": "affected", "version": "0", "lessThan": "5.4", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-05T18:15:55.523", "references": [{"url": "https://advcloudfiles.advantech.com/cms/2ca1b071-fd78-4d7f-8a2a-7b4537a95d19/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----DeviceOn-20251208-2.pdf", "source": "disclosure@vulncheck.com"}, {"url": "https://docs.deviceon.advantech.com/docs/resource/", "tags": ["Product"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/advantech-wise-deviceon-server-authenticated-stored-xss-via-devicemap-building", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Advantech WISE-DeviceOn Server versions prior to 5.4\u00a0contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devicemap/building endpoint. When an authenticated user creates a map entry, the name parameter is stored and later rendered in the map list UI without HTML sanitzation. An attacker can inject malicious script into the map entry name, which is then executed in the browser context of users who view or interact with the affected map entry, potentially enabling session compromise and unauthorized actions as the victim."}, {"lang": "es", "value": "Advantech WISE-DeviceOn Server versiones anteriores a 5.4 contiene una vulnerabilidad de cross?site scripting (XSS) almacenada en el endpoint **/rmm/v1/devicemap/building. Cuando un usuario autenticado crea una entrada de mapa, el par\u00e1metro name se almacena y luego se muestra en la interfaz de lista de mapas sin sanitizaci\u00f3n HTML. Un atacante puede inyectar script malicioso en el nombre de la entrada de mapa, que se ejecuta en el contexto del navegador de los usuarios que visualizan o interact\u00faan con la entrada de mapa afectada, lo que potencialmente permite la compromisi\u00f3n de sesi\u00f3n y acciones no autorizadas como la v\u00edctima."}], "lastModified": "2026-10-18T14:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:advantech:wise-deviceon_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BFB1F2C4-C260-473E-A6E1-EE7DFC3EF083", "versionEndExcluding": "5.4"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}