Advantech Wise-Deviceon Server vulnerabilities

11 CVEs affecting Advantech Wise-Deviceon Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-34266, published 2025-12-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-34256, published 2025-12-05. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. Advantech WISE-DeviceOn Server versions prior to 5.4 contain a hard-coded cryptographic key vulnerability. The product uses a static HS512 HMAC secret for signing EIRMMToken JWTs across all…
CVE-2025-34261, published 2025-12-05. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devicegroups/ endpoint. When an authenticated user creates a device…
CVE-2025-34259, published 2025-12-05. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devicemap/building endpoint. When an authenticated user creates a map…
CVE-2025-34257, published 2025-12-05. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/action/defined endpoint. When an authenticated user creates a task, the…
CVE-2025-34260, published 2025-12-05. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/action/schedule endpoint. When an authenticated user adds a schedule to…
CVE-2025-34266, published 2025-12-05. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/plugin-config/addins/menus endpoint. When an authenticated user adds or…
CVE-2025-34262, published 2025-12-05. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devices/name/{agent_id} endpoint. When an authenticated user renames a…
CVE-2025-34258, published 2025-12-05. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devicemap/plan endpoint. When an authenticated user adds an area to a map…
CVE-2025-34265, published 2025-12-05. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/rule-engines endpoint. When an authenticated user creates or updates a…
CVE-2025-34264, published 2025-12-05. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/dog/{agentId} endpoint. When an authenticated user adds or edits Software…

Latest

CVE-2025-34263, published 2025-12-05. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/plugin-config/dashboards/menus endpoint. When an authenticated user adds…