CVE-2025-34262 Overview
CVE-2025-34262 is a stored cross-site scripting (XSS) vulnerability affecting Advantech WISE-DeviceOn Server versions prior to 5.4. The flaw resides in the /rmm/v1/devices/name/{agent_id} endpoint, which handles device rename operations. When an authenticated user renames a device, the new_name value is stored server-side and later rendered in device listings and detail views without proper HTML sanitation. An attacker with a low-privileged account can inject JavaScript into the device name field, causing execution in the browser context of any user who views the affected device. This vulnerability is tracked under CWE-79.
Critical Impact
Successful exploitation enables session compromise, credential theft, and unauthorized actions performed in the browser context of legitimate WISE-DeviceOn operators.
Affected Products
- Advantech WISE-DeviceOn Server versions prior to 5.4
- Deployments exposing the /rmm/v1/devices/name/{agent_id} REST endpoint
- Web management consoles rendering device names in listings or detail views
Discovery Timeline
- 2025-12-05 - CVE-2025-34262 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-34262
Vulnerability Analysis
The vulnerability originates in the device rename workflow exposed by the WISE-DeviceOn Server REST API. The /rmm/v1/devices/name/{agent_id} endpoint accepts a new_name parameter from authenticated users. The server persists the value directly and later reflects it into HTML views without encoding output. Any user who loads the device list or detail page triggers execution of the injected script under the origin of the WISE-DeviceOn console. Because the payload is stored, exploitation is persistent and affects every subsequent viewer, including administrators. Session cookies, authentication tokens, and API actions available to the victim become reachable to the attacker.
Root Cause
The root cause is missing output encoding of user-supplied device names in the front-end rendering pipeline. Input validation on the rename endpoint does not reject or neutralize HTML control characters such as <, >, or event-handler attributes. The stored value is later inserted into the DOM as markup rather than as text content, allowing arbitrary script execution.
Attack Vector
Exploitation requires network access to the WISE-DeviceOn management interface and valid low-privileged credentials. An attacker issues a PUT or POST request to the /rmm/v1/devices/name/{agent_id} endpoint with a script payload embedded in the new_name value. The payload persists in the device record. When an administrator or operator subsequently opens the device listing or detail view, the browser executes the payload in the context of the WISE-DeviceOn origin. Because user interaction (loading the affected page) is required, this vulnerability requires a victim to navigate to the compromised device view. Refer to the Vulncheck advisory for additional technical detail.
Detection Methods for CVE-2025-34262
Indicators of Compromise
- Device records containing HTML tags, JavaScript keywords, or event-handler attributes such as onerror=, onload=, or <script> in the name field
- HTTP requests to /rmm/v1/devices/name/{agent_id} with payloads containing angle brackets, encoded script fragments, or unusual character sequences
- Outbound browser requests from operator sessions to unfamiliar external hosts shortly after viewing device listings
Detection Strategies
- Inspect the WISE-DeviceOn database for device names containing markup or scripting syntax and audit the rename history
- Monitor web server access logs for PUT/POST requests to the vulnerable endpoint with suspicious payload patterns
- Deploy web application firewall (WAF) rules that flag XSS signatures on the new_name parameter
Monitoring Recommendations
- Log all authenticated changes to device metadata and correlate rename events with the source user account
- Alert on Content Security Policy (CSP) violations reported by operator browsers accessing the management console
- Track anomalous session activity such as unexpected API calls issued by administrator sessions immediately after browsing device pages
How to Mitigate CVE-2025-34262
Immediate Actions Required
- Upgrade Advantech WISE-DeviceOn Server to version 5.4 or later as documented in the Advantech Security Advisory
- Audit existing device names for injected HTML or script content and sanitize affected records
- Rotate session tokens and credentials for any accounts that accessed device views on unpatched systems
Patch Information
Advantech has released WISE-DeviceOn Server version 5.4, which addresses the stored XSS by applying proper output encoding on rendered device names. Administrators should follow the deployment guidance in the DeviceOn Resource Documentation and validate the fix in a staging environment before rolling out to production.
Workarounds
- Restrict network access to the WISE-DeviceOn management console to trusted administrative subnets using firewall rules
- Enforce least-privilege on user accounts to reduce the population of users authorized to rename devices
- Deploy a strict Content Security Policy that disallows inline script execution in the management console
- Instruct operators to avoid interacting with device entries whose names contain unexpected characters until patching is complete
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.