Which versions of Advantech WISE-DeviceOn Server are affected by CVE-2025-34256?

A critical authentication bypass vulnerability in Advantech WISE-DeviceOn Server allows unauthenticated attackers to forge administrative credentials and gain complete control over the platform and…. A patch is available.

How to fix or mitigate CVE-2025-34256?

Within 24 hours: Identify all WISE-DeviceOn Server instances and their versions; isolate affected systems from untrusted networks; restrict network access to administrative interfaces. Within 7 days: Implement network segmentation and WAF rules to block suspicious JWT patterns; monitor logs for unauthorized token generation and authentication anomalies; contact Advantech for patch timelines. Within 30 days: Upgrade to version 5.4 or later when available; conduct forensic analysis for signs of compromise; rotate all credentials and review access logs for suspicious administrative activity.

Advantech WISE-DeviceOn Server CVE-2025-34256

Q: What is the CVSS score of CVE-2025-34256?

CVE-2025-34256 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2025-201428 CRITICAL

Use of Hard-coded Cryptographic Key (CWE-321)

2025-12-05 disclosure@vulncheck.com

RCE

10.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

5.4

CVSS changed

Apr 15, 2026 - 19:22 NVD

9.8 (CRITICAL) 10.0 (CRITICAL)

EUVD ID Assigned

Mar 15, 2026 - 17:08 euvd

EUVD-2025-201428

Analysis Generated

Mar 15, 2026 - 17:08 vuln.today

CVE Published

Dec 05, 2025 - 18:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Advantech WISE-DeviceOn Server versions prior to 5.4 contain a hard-coded cryptographic key vulnerability. The product uses a static HS512 HMAC secret for signing EIRMMToken JWTs across all installations. The server accepts forged JWTs that need only contain a valid email claim, allowing a remote unauthenticated attacker to generate arbitrary tokens and impersonate any DeviceOn account, including the root super admin. Successful exploitation permits full administrative control of the DeviceOn instance and can be leveraged to execute code on managed agents through DeviceOn’s remote management features.