Vulnerabilities

TI-2025-24399 CVE-2025-34256 · GHSA-vqjp-fh8j-rf3j

Advantech WISE-DeviceOn Server < 5.4 Hard-coded JWT Key Authentication Bypass

HIGH 82

Advantech WISE-DeviceOn Server versions prior to 5.4 contain a hard-coded cryptographic key vulnerability.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00741 Published 2025-12-05 Fixed in 5.4.0 CWE-321

TI-2025-24408 CVE-2025-34265 · GHSA-rprg-cfwr-h8p5

Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via rule-engines

LOW 23

Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/rule-engines endpoint.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00216 Published 2025-12-05 Fixed in 5.4 CWE-79

TI-2025-24406 CVE-2025-34263 · GHSA-g9pj-8p3r-6jw4

Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via plugin-config/dashboards/menus

LOW 23

Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/plugin-config/dashboards/menus endpoint.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00216 Published 2025-12-05 Fixed in 5.4 CWE-79

TI-2025-24409 CVE-2025-34266 · GHSA-r3qf-jhw8-r9hq

Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via plugin-config/addins/menus

LOW 23

Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/plugin-config/addins/menus endpoint.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00228 Published 2025-12-05 Fixed in 5.4 CWE-79

TI-2025-24407 CVE-2025-34264 · GHSA-p8wc-v68c-38qm

Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via dog/{agentId}

LOW 23

Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/dog/{agentId} endpoint.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00216 Published 2025-12-05 Fixed in 5.4 CWE-79

TI-2025-24405 CVE-2025-34262 · GHSA-6phq-vcg5-3cgq

Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devices/name/{agent_id}

LOW 23

Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devices/name/{agent_id} endpoint.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00228 Published 2025-12-05 Fixed in 5.4 CWE-79

TI-2025-24401 CVE-2025-34258 · GHSA-qqfj-p2gp-5qq5

Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devicemap/plan

LOW 23

Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devicemap/plan endpoint.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00228 Published 2025-12-05 Fixed in 5.4 CWE-79

TI-2025-24402 CVE-2025-34259 · GHSA-784q-w3gc-8rm2

Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devicemap/building

LOW 23

Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devicemap/building endpoint.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00277 Published 2025-12-05 Fixed in 5.4 CWE-79

TI-2025-24404 CVE-2025-34261 · GHSA-54mr-945x-r486

Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devicegroups/

LOW 23

Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devicegroups/ endpoint.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00277 Published 2025-12-05 Fixed in 5.4 CWE-79

TI-2025-24403 CVE-2025-34260 · GHSA-j693-gfw6-g39f

Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via action/schedule

LOW 23

Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/action/schedule endpoint.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00272 Published 2025-12-05 Fixed in 5.4 CWE-79

TI-2025-24400 CVE-2025-34257 · GHSA-jqf3-hfq7-53x7

Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via action/defined

LOW 23

Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/action/defined endpoint.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00277 Published 2025-12-05 Fixed in 5.4 CWE-79

Vulnerabilities

Filters