CVE-2025-34256: falha crítica em Advantech Co., Ltd. WISE-DeviceOn Server
Advantech WISE-DeviceOn Server < 5.4 Hard-coded JWT Key Authentication Bypass
Publicada em · Atualizada em
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 10epss 0.7%
probabilidade de exploração
0.7%top 49% das CVEs
exploração observada
nãonenhuma fonte reporta
Advantech WISE-DeviceOn Server versions prior to 5.4 contain a hard-coded cryptographic key vulnerability. The product uses a static HS512 HMAC secret for signing EIRMMToken JWTs across all installations. The server accepts forged JWTs that need only contain a valid email claim, allowing a remote unauthenticated attacker to generate arbitrary tokens and impersonate any DeviceOn account, including the root super admin. Successful exploitation permits full administrative control of the DeviceOn instance and can be leveraged to execute code on managed agents through DeviceOn’s remote management features.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Produtos afetados
Advantech Co., Ltd. · WISE-DeviceOn ServerCVEs relacionadas — Advantech Co., Ltd. WISE-DeviceOn Server
No mesmo produto, das mais perigosas para as menos.
CVE-2025-34259MEDIUMAdvantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devicemap/buildingEPSS 0.3%CVE-2025-34261MEDIUMAdvantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devicegroups/EPSS 0.3%CVE-2025-34257MEDIUMAdvantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via action/definedEPSS 0.3%CVE-2025-34260MEDIUMAdvantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via action/scheduleEPSS 0.3%CVE-2025-34266MEDIUMAdvantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via plugin-config/addins/menusEPSS 0.2%CVE-2025-34262MEDIUMAdvantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devices/name/{agent_id}EPSS 0.2%
Referências
https://advcloudfiles.advantech.com/cms/2ca1b071-fd78-4d7f-8a2a-7b4537a95d19/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----DeviceOn-20251208-2.pdfhttps://docs.deviceon.advantech.com/docs/resource/https://pellera.com/blog/advantech-wise-deviceon-cve-2025-34256-vulnerability/https://www.vulncheck.com/advisories/advantech-wise-deviceon-server-hardcoded-jwt-key-authentication-bypass