CVE-2025-34259: Advantech WISE-DeviceOn Server XSS Flaw

CVE-2025-34259 Overview

CVE-2025-34259 is a stored cross-site scripting (XSS) vulnerability in Advantech WISE-DeviceOn Server versions prior to 5.4. The flaw resides in the /rmm/v1/devicemap/building endpoint, where authenticated users can submit map entries whose name parameter is stored and later rendered in the map list UI without HTML sanitization. An attacker who injects a malicious script into the map entry name causes that script to execute in the browser context of any user viewing the affected map. Successful exploitation can lead to session compromise and unauthorized actions performed as the victim. The weakness is classified under CWE-79.

Critical Impact
Authenticated attackers can persist JavaScript payloads that execute against administrators and operators, enabling session hijacking and unauthorized actions in the WISE-DeviceOn management console.

Affected Products

Advantech WISE-DeviceOn Server versions prior to 5.4
Deployments exposing the /rmm/v1/devicemap/building endpoint
Browser-based operator and administrator sessions interacting with the map list UI

Discovery Timeline

2025-12-05 - CVE-2025-34259 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-34259

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the map management workflow of WISE-DeviceOn Server. When an authenticated user creates a building map entry through the /rmm/v1/devicemap/building API, the server persists the name parameter without applying HTML encoding or input sanitization. The stored value is later rendered directly into the map list interface. Any script contained in the name field executes in the browser session of every user who loads the map list. Because the payload is persistent, a single low-privileged account with map creation rights can affect every operator or administrator that subsequently interacts with the affected view.

Root Cause

The root cause is missing output encoding on server-rendered content sourced from user-controlled input. The name field of a map entry is stored verbatim and injected into the DOM without escaping HTML control characters such as <, >, and ". This satisfies the classic conditions for CWE-79 (Improper Neutralization of Input During Web Page Generation).

Attack Vector

Exploitation requires network access to the WISE-DeviceOn Server and valid authenticated credentials with permission to create map entries. The attacker submits a crafted name value containing JavaScript through the /rmm/v1/devicemap/building endpoint. When a privileged user opens the map list, the payload executes in their browser context. Attackers can use this primitive to exfiltrate session tokens, issue authenticated API calls, or pivot to further administrative actions. Refer to the VulnCheck Advisory for XSS for endpoint-level technical details.

// No verified proof-of-concept is published for CVE-2025-34259.
// See the vendor and VulnCheck advisories for endpoint and payload context.

Detection Methods for CVE-2025-34259

Indicators of Compromise

HTTP POST or PUT requests to /rmm/v1/devicemap/building containing HTML tags, <script> fragments, or event-handler attributes such as onerror= and onload= in the name field.
Map entries whose name values include encoded payloads such as javascript:, <script, or %3Cscript%3E.
Unexpected outbound browser requests from operator workstations to attacker-controlled hosts shortly after loading the WISE-DeviceOn map list.

Detection Strategies

Inspect application logs for map creation events with name values that fail an allow-list of alphanumeric and whitespace characters.
Deploy web application firewall (WAF) rules that flag script tags, HTML entities, and JavaScript URI schemes submitted to /rmm/v1/devicemap/building.
Correlate authenticated API activity with subsequent anomalous session behavior such as new API tokens or privilege changes.

Monitoring Recommendations

Enable verbose audit logging on WISE-DeviceOn Server API endpoints and forward events to a centralized SIEM for pattern analysis.
Baseline normal map entry naming conventions and alert on entries containing angle brackets, quotes, or backticks.
Monitor administrative browser sessions for anomalous DOM-initiated requests originating from the map list UI.

How to Mitigate CVE-2025-34259

Immediate Actions Required

Upgrade Advantech WISE-DeviceOn Server to version 5.4 or later as documented in the Advantech Security Advisory.
Audit existing map entries for name values containing HTML or JavaScript syntax and remove malicious content.
Restrict map creation permissions to trusted administrative accounts until the patch is applied.

Patch Information

Advantech has released WISE-DeviceOn Server 5.4, which addresses the stored XSS by sanitizing input and encoding output for map entry names. Administrators should review the Advantech Security Advisory and the DeviceOn Resource Documentation for upgrade steps.

Workarounds

Place the WISE-DeviceOn management interface behind a reverse proxy or WAF that filters HTML and script characters in POST bodies targeting /rmm/v1/devicemap/building.
Enforce a strict Content Security Policy (CSP) that blocks inline script execution in the WISE-DeviceOn web UI.
Revoke map creation rights from non-administrative roles until the environment is upgraded to version 5.4.

bash

# Example NGINX rule to block obvious script payloads in map creation requests
location /rmm/v1/devicemap/building {
    if ($request_body ~* "(<script|onerror=|onload=|javascript:)") {
        return 403;
    }
    proxy_pass http://wise_deviceon_backend;
}