CVE-2025-48470mediumCWE-79

CVE-2025-48470: medium-severity vulnerability in Advantech Wireless Sensing and Equipment (WISE)

Stored Cross site Scripting (XSS)

Published · Updated

Follow this CVE+ Monitor Advantech Wireless Sensing and Equipment

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.1epss 0.2%
Successful exploitation of the stored cross-site scripting vulnerability could allow an attacker to inject malicious scripts into device fields and executed in other users’ browser, potentially leading to session hijacking, defacement, credential theft, or privilege escalation.
CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
Affected products
Advantech · Advantech Wireless Sensing and Equipment (WISE)
Related CVEs — Advantech Wireless Sensing and Equipment (WISE)

In the same product, most dangerous first.

CVE-2025-48466HIGHModbus Command Injection without AuthenticationEPSS 0.6%CVE-2025-48469CRITICALUnauthenticated Firmware UploadEPSS 0.5%CVE-2025-48461MEDIUMWeak Session Cookie EntropyEPSS 0.5%CVE-2025-48467MEDIUMDenial of Service via Malformed Modbus PacketsEPSS 0.2%CVE-2025-48462MEDIUMLogin Session ExhaustionEPSS 0.2%CVE-2025-48468MEDIUMOpen JTAG Debug PortEPSS 0.2%