CVE-2025-34261: Advantech WISE-DeviceOn Server XSS Flaw

CVE-2025-34261 Overview

CVE-2025-34261 is a stored cross-site scripting (XSS) vulnerability in Advantech WISE-DeviceOn Server versions prior to 5.4. The flaw resides in the /rmm/v1/devicegroups/ endpoint, where the name and description fields submitted during device group creation are stored without proper HTML sanitation. When other users render device group listings, the injected payload executes in their browser context. The issue is categorized under CWE-79 and requires an authenticated user to trigger the injection.

Critical Impact
Authenticated attackers can inject persistent JavaScript that executes in the sessions of administrators viewing device group listings, enabling session compromise and unauthorized actions against the WISE-DeviceOn management console.

Affected Products

Advantech WISE-DeviceOn Server versions prior to 5.4
/rmm/v1/devicegroups/ API endpoint (device group name field)
/rmm/v1/devicegroups/ API endpoint (device group description field)

Discovery Timeline

2025-12-05 - CVE-2025-34261 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-34261

Vulnerability Analysis

WISE-DeviceOn Server is Advantech's remote device management platform used to monitor and manage industrial IoT endpoints. The server exposes a REST API at /rmm/v1/devicegroups/ that allows authenticated operators to create and manage device groups. Each group accepts a name and description value, both of which are persisted to the backend datastore.

When the management interface later renders device group listings, the stored name and description values are inserted into HTML without contextual output encoding. Any script content submitted during group creation is therefore executed in the browser context of any user who views the affected group. Because the payload is persistent, every authorized viewer of the group triggers execution on each page load.

Exploitation requires only low-privileged authenticated access to create a device group. High-privileged administrators who subsequently visit the device group listing become the primary victim, allowing privilege pivot within the management application.

Root Cause

The root cause is missing HTML sanitization and output encoding on user-supplied device group metadata. The server accepts arbitrary UTF-8 strings for name and description, stores them verbatim, and the frontend renders them into the DOM without escaping HTML control characters such as <, >, and quote delimiters. This aligns with CWE-79: Improper Neutralization of Input During Web Page Generation.

Attack Vector

An attacker with valid low-privilege credentials issues an authenticated POST request to /rmm/v1/devicegroups/ containing a JavaScript payload in the name or description field. The server persists the malicious value. When a higher-privileged operator loads the device group listing view, the browser parses the injected markup and executes the attacker's script under the origin of the WISE-DeviceOn console.

At that point the script can read session cookies not marked HttpOnly, issue authenticated API calls on behalf of the victim, exfiltrate device inventory data, or modify device group membership. The vulnerability requires user interaction from the victim (viewing the poisoned listing), reflected in the CVSS 4.0 vector by UI:P.

The vulnerability manifests in how the device group endpoint handles input. Refer to the VulnCheck advisory for additional technical detail.

Detection Methods for CVE-2025-34261

Indicators of Compromise

Device group records containing HTML tags such as <script>, <img onerror=>, or <svg onload=> in the name or description fields.
Outbound HTTP requests from administrator browsers to unfamiliar domains immediately after loading the device group management page.
Unexpected API calls to /rmm/v1/devicegroups/ or related endpoints originating from an administrator session shortly after browsing device groups.
New or modified device groups created by low-privileged accounts that were not previously active in group management.

Detection Strategies

Query the WISE-DeviceOn database or API for device group name and description values matching regex patterns for HTML tags, event handlers (onerror, onload, onclick), or javascript: URIs.
Deploy web application firewall (WAF) rules on requests to /rmm/v1/devicegroups/ that block payloads containing script-like syntax in JSON body fields.
Enable Content Security Policy (CSP) reporting on the management console and alert on script-src violations originating from the device group view.
Correlate authentication logs with device group creation events to identify accounts creating groups outside their normal role scope.

Monitoring Recommendations

Enable verbose audit logging for all POST, PUT, and DELETE requests against /rmm/v1/devicegroups/ including full request bodies.
Monitor browser-side console errors and CSP violation reports from administrator workstations accessing the WISE-DeviceOn UI.
Track anomalous session activity such as concurrent sessions from a single administrator account or API calls issued from unusual user-agent strings.

How to Mitigate CVE-2025-34261

Immediate Actions Required

Upgrade Advantech WISE-DeviceOn Server to version 5.4 or later, which addresses the stored XSS in the device groups endpoint.
Audit existing device group records for HTML or script content and remove or sanitize any offending entries.
Rotate session tokens and credentials for administrators who accessed the device group listing since the vulnerable version was deployed.
Restrict device group creation privileges to a minimal set of trusted operators until patching is complete.

Patch Information

Advantech has released WISE-DeviceOn Server version 5.4 to remediate CVE-2025-34261. Consult the Advantech Security Advisory for upgrade procedures and the DeviceOn Resource Documentation for deployment guidance. Apply the patch on all server instances, including any staging or lab environments that share user accounts with production.

Workarounds

Place the WISE-DeviceOn management console behind a reverse proxy that enforces a strict Content Security Policy disallowing inline scripts.
Configure WAF rules to reject requests to /rmm/v1/devicegroups/ containing angle brackets or common XSS payload signatures in JSON string values.
Limit administrative access to the management UI to isolated jump hosts with dedicated browsers that do not share cookies with other applications.
Enforce role-based access control so that only vetted accounts can create or modify device groups until the upgrade is deployed.

bash

# Example WAF rule (ModSecurity) blocking script-like input on the device groups endpoint
SecRule REQUEST_URI "@beginsWith /rmm/v1/devicegroups/" \
    "id:1003426,\
    phase:2,\
    t:none,t:lowercase,\
    chain,\
    deny,status:400,\
    msg:'Potential XSS payload in WISE-DeviceOn device group field (CVE-2025-34261)'"
    SecRule REQUEST_BODY "@rx (<script|onerror\s*=|onload\s*=|javascript:)" \
        "t:none,t:lowercase"