Executive Summary

This vulnerability exists in Advantech WISE-DeviceOn Server versions prior to 5.4, where a hard-coded cryptographic key is used. Specifically, the product uses a static HS512 HMAC secret to sign EIRMMToken JWTs across all installations. Because the key is static and hard-coded, an attacker can forge JWTs by including only a valid email claim, allowing them to impersonate any DeviceOn account, including the root super admin. This enables the attacker to gain full administrative control over the DeviceOn instance and potentially execute code on managed agents via remote management features.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is severe. A remote unauthenticated attacker can generate arbitrary tokens to impersonate any user, including the highest privileged root super admin account. This grants the attacker full administrative control of the DeviceOn instance. Additionally, the attacker can leverage this control to execute arbitrary code on managed agents through the remote management capabilities of DeviceOn, potentially compromising the entire managed environment.

Useful 0 Not Useful 0

Mitigation Strategies

Users are strongly advised to update to WISE-DeviceOn Server version 5.4 or later, where the hard-coded cryptographic key vulnerability has been fixed by replacing the static key with a system that dynamically generates and securely manages cryptographic keys for EIRMMToken authentication. [1]

Useful 0 Not Useful 0