CVE-2025-34256

All product installations use an identical, static HMAC HS512 secret for signing JWT tokens of type EIRMMToken. The server accepts JWT tokens that contain only a valid 'email' field — an attacker can independently generate a properly signed token without knowing any authentication credentials. Because the key is identical across all installations (hardcoded), the exploit works against every vulnerable version of WISE-DeviceOn server. The obtained token allows impersonation of any account, including the super administrator (root) account.

The attacker gains full administrative control over the WISE-DeviceOn instance, enabling them to execute code on managed agency devices through the platform's built-in remote management functions.

Immediately update Advantech WISE-DeviceOn Server to version 5.4 or newer, in accordance with the vendor's recommendations published in Security Advisory SECURITY-ADVISORY----DeviceOn-20251208-2. Until the patch is deployed, it is recommended to restrict network access to the WISE-DeviceOn server exclusively to trusted IP addresses at the firewall level.

Advantech WISE-DeviceOn Server versions prior to 5.4