CVE-2025-34256
Last modified
CVE-2025-34256 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Advantech WISE-DeviceOn Server versions prior to 5.4 contain a hard-coded cryptographic key vulnerability. The product uses a static HS512 HMAC secret for signing EIRMMToken JWTs across all installations. EPSS estimates a 0.59% chance of exploitation in the next 30 days.
Description
Advantech WISE-DeviceOn Server versions prior to 5.4 contain a hard-coded cryptographic key vulnerability. The product uses a static HS512 HMAC secret for signing EIRMMToken JWTs across all installations. The server accepts forged JWTs that need only contain a valid email claim, allowing a remote unauthenticated attacker to generate arbitrary tokens and impersonate any DeviceOn account, including the root super admin. Successful exploitation permits full administrative control of the DeviceOn instance and can be leveraged to execute code on managed agents through DeviceOn’s remote management features.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Advantech | Wise-Deviceon Server | < 5.4 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2025-34256?
How severe is CVE-2025-34256?
How do I fix CVE-2025-34256?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-34250Rejected reason: This CVE ID was rejected because it was res…
- CVE-2025-34251Tesla Telematics Control Unit (TCU) firmware prior to v2025.…8.6
- CVE-2025-34252Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2025-34253D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain …5.4
- CVE-2025-34254D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain …5.3
- CVE-2025-34255D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain …5.3
- CVE-2025-34257Advantech WISE-DeviceOn Server versions prior to 5.4 contain…5.4
- CVE-2025-34258Advantech WISE-DeviceOn Server versions prior to 5.4 contain…5.4
- CVE-2025-34259Advantech WISE-DeviceOn Server versions prior to 5.4 contain…5.4
- CVE-2025-3426We observed that Intellispace Portal binaries doesn’t have a…7.2
- CVE-2025-34260Advantech WISE-DeviceOn Server versions prior to 5.4 contain…5.4
- CVE-2025-34261Advantech WISE-DeviceOn Server versions prior to 5.4 contain…5.4
Are you affected by CVE-2025-34256?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST