CVE-2025-34260: Advantech WISE-DeviceOn Server XSS Flaw

CVE-2025-34260 Overview

CVE-2025-34260 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Advantech WISE-DeviceOn Server versions prior to 5.4. The flaw exists in the /rmm/v1/action/schedule endpoint, which fails to sanitize HTML content when authenticated users add schedules to existing tasks. Stored schedule names execute in the browser context of any user who views the affected schedule listing. An attacker with valid credentials can inject malicious JavaScript that runs against other users, enabling session compromise and unauthorized actions performed as the victim.

Critical Impact
Authenticated attackers can inject persistent JavaScript into schedule listings, hijack sessions of administrators or operators, and perform unauthorized actions within the WISE-DeviceOn remote management platform.

Affected Products

Advantech WISE-DeviceOn Server versions prior to 5.4
Deployments exposing the /rmm/v1/action/schedule endpoint
Environments where multiple authenticated users interact with shared schedule listings

Discovery Timeline

2025-12-05 - CVE-2025-34260 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-34260

Vulnerability Analysis

The vulnerability resides in the schedule creation workflow of the WISE-DeviceOn Server remote management platform. When an authenticated user submits a request to /rmm/v1/action/schedule to add a schedule to an existing task, the server stores the supplied schedule name without applying HTML sanitation. The stored value is later rendered directly into schedule listing pages served to other authenticated users.

Because the payload persists in the backend and executes each time a user renders the schedule list, this is a stored XSS rather than a reflected variant. The execution context is the authenticated session of the victim, which typically includes remote device management privileges. Attackers can leverage this to exfiltrate session tokens, invoke administrative API calls, or pivot to connected industrial devices managed through the platform.

Root Cause

The root cause is missing output encoding and input sanitation on the schedule name field. The application trusts client-supplied text and reflects it into HTML without escaping characters such as <, >, and ". This violates standard secure output handling guidance for HTML contexts described in [CWE-79].

Attack Vector

Exploitation requires network access to the WISE-DeviceOn Server web interface and valid low-privilege credentials. The attacker submits a schedule creation request with a JavaScript payload embedded in the schedule name field. When another authenticated user, typically an operator or administrator, opens the schedule listing view, the payload executes in their browser under the origin of the WISE-DeviceOn Server. User interaction from the victim is required to trigger execution.

No verified public proof-of-concept code is available. See the VulnCheck Advisory on XSS for additional technical context.

Detection Methods for CVE-2025-34260

Indicators of Compromise

Schedule entries in WISE-DeviceOn containing HTML tags, <script> markup, event handlers such as onerror= or onload=, or javascript: URIs in the schedule name field.
HTTP POST requests to /rmm/v1/action/schedule where the schedule name parameter contains encoded angle brackets, backticks, or JavaScript keywords.
Unexpected outbound requests from operator or administrator browsers to attacker-controlled domains shortly after viewing schedule listings.

Detection Strategies

Inspect application logs and database records for schedule names containing markup or script fragments and quarantine matching entries.
Deploy a web application firewall rule that blocks requests to /rmm/v1/action/schedule when the JSON body contains characters commonly used in XSS payloads.
Monitor authenticated session activity for anomalous administrative actions performed in short succession after schedule list access.

Monitoring Recommendations

Enable verbose access logging on the WISE-DeviceOn Server web tier and forward logs to a centralized analytics platform for retention and search.
Alert on new user account creations, permission changes, or bulk device commands issued immediately after a schedule listing view.
Track browser-side error telemetry and Content Security Policy violation reports from client machines that access the WISE-DeviceOn console.

How to Mitigate CVE-2025-34260

Immediate Actions Required

Upgrade Advantech WISE-DeviceOn Server to version 5.4 or later as specified in the Advantech Security Advisory.
Audit existing schedule entries for injected markup and delete or sanitize any suspicious records before restoring normal operations.
Rotate authentication tokens and passwords for administrative accounts that may have viewed malicious schedule entries.

Patch Information

Advantech has released WISE-DeviceOn Server version 5.4, which addresses the missing HTML sanitation in the /rmm/v1/action/schedule endpoint. Refer to the vendor advisory and the DeviceOn Resource Documentation for upgrade procedures and release notes. Apply the patch in a maintenance window and verify schedule rendering behavior after upgrade.

Workarounds

Restrict access to the WISE-DeviceOn Server web interface to trusted management networks using firewall or VPN controls.
Limit schedule creation privileges to a minimal set of trusted users until the patch is deployed.
Deploy a reverse proxy rule that strips or rejects HTML control characters in requests to the schedule endpoint.

bash

# Example NGINX reverse proxy rule to block script markup in schedule requests
location /rmm/v1/action/schedule {
    if ($request_body ~* "(<script|onerror=|onload=|javascript:)") {
        return 403;
    }
    proxy_pass http://wise_deviceon_backend;
}