CVE-2025-34266
BaseFortify
Publication date: 2025-12-05
Last updated on: 2025-12-17
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| advantech | wise-deviceon_server | to 5.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a stored cross-site scripting (XSS) issue in Advantech WISE-DeviceOn Server versions prior to 5.4. It occurs in the /rmm/v1/plugin-config/addins/menus endpoint, where an authenticated user can add or edit AddIns menu entries. The label and path values are stored without proper HTML sanitation and later rendered in the AddIns UI. An attacker can inject malicious scripts into these fields, which execute in the browser of users who view or interact with the affected AddIns entry, potentially leading to session compromise and unauthorized actions.
How can this vulnerability impact me? :
The vulnerability can lead to session compromise and unauthorized actions performed by attackers in the context of affected users. Malicious scripts injected via the AddIns menu entries can execute in users' browsers, potentially allowing attackers to hijack sessions, steal sensitive information, or perform actions on behalf of the victim users.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves verifying if your Advantech WISE-DeviceOn Server version is prior to 5.4 and checking for suspicious or malicious script injections in the /rmm/v1/plugin-config/addins/menus endpoint, specifically in the 'label' and 'path' fields of AddIns menu entries. You can monitor HTTP requests to this endpoint for unusual input patterns or scripts. Since this is an authenticated stored XSS, commands to inspect logs or HTTP traffic might include using tools like curl or wget to query the endpoint with authenticated sessions, or using web application scanners that detect stored XSS vulnerabilities. Example command to check the version: `curl -k -u <user>:<password> https://<deviceon-server>/api/version` (replace with actual API if available). For detecting malicious entries, manual inspection or automated scanning of the plugin configuration data for script tags or suspicious HTML in 'label' and 'path' fields is recommended. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Advantech WISE-DeviceOn Server to version 5.4 or later, where this stored XSS vulnerability has been fixed. Additionally, restrict authenticated user permissions to limit who can add or edit AddIns menu entries, and educate users to avoid interacting with suspicious AddIns entries. Implement web application firewall (WAF) rules to detect and block malicious script injections targeting the /rmm/v1/plugin-config/addins/menus endpoint. [1]