Is there a patch available for CVE-2025-34256?

Yes, a patch is available for CVE-2025-34256. Update the affected software to the latest version immediately.

Wise Deviceon Server CVE-2025-34256

Q: What is the CVSS score of CVE-2025-34256?

CVE-2025-34256 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2025-201428 CRITICAL

Use of Hard-coded Cryptographic Key (CWE-321)

2025-12-05 disclosure@vulncheck.com

RCE Wise Deviceon Server Advantech

10.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

5.4

CVSS changed

Apr 15, 2026 - 19:22 NVD

9.8 (CRITICAL) 10.0 (CRITICAL)

EUVD ID Assigned

Mar 15, 2026 - 17:08 euvd

EUVD-2025-201428

Analysis Generated

Mar 15, 2026 - 17:08 vuln.today

CVE Published

Dec 05, 2025 - 18:15 cve.org

CRITICAL 10.0

CVE Published

Dec 05, 2025 - 18:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Advantech WISE-DeviceOn Server versions prior to 5.4 contain a hard-coded cryptographic key vulnerability. The product uses a static HS512 HMAC secret for signing EIRMMToken JWTs across all installations. The server accepts forged JWTs that need only contain a valid email claim, allowing a remote unauthenticated attacker to generate arbitrary tokens and impersonate any DeviceOn account, including the root super admin. Successful exploitation permits full administrative control of the DeviceOn instance and can be leveraged to execute code on managed agents through DeviceOn’s remote management features.

AnalysisAI

Remote authentication bypass in Advantech WISE-DeviceOn Server allows unauthenticated attackers to forge JSON Web Tokens using a static HMAC secret, gaining full administrative control and the ability to execute arbitrary code on managed agents. With a CVSS score of 10.0, the vulnerability enables impersonation of any account, including the root super admin, if the attacker can guess a valid email address. No active exploitation has been reported at time of analysis, but the nature of the flaw makes exploitation trivial.