CVE-2025-34266: wise-deviceon server before 5.4 (exclusive); +1 more affected products

Affected technology

wise-deviceon server · before 5.4 (exclusive)
advantech

WISE-DeviceOn Server · 0 to before 5.4
Advantech Co., Ltd.

Description’s affected range: versions prior to 5.4

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · Passive user interaction

What an attacker can do

An attacker can inject malicious script into either field, which is then executed in the browser context of users who view or interact with the affected AddIns entry, potentially enabling session compromise and unauthorized actions as the victim. Vendor/CNA’s CVSS 4.0 assessment (base score 5.1/10) rates confidentiality and integrity impact as low; availability impact as none.