CVE-2025-34256

Katalog CVE

CVSS 9.8 · Critical EPSS 0,69%

Kerentanan Use of Hard-coded Cryptographic Key pada advantech wise-deviceon server. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Advantech WISE-DeviceOn Server versions prior to 5.4 contain a hard-coded cryptographic key vulnerability. The product uses a static HS512 HMAC secret for signing EIRMMToken JWTs across all installations. The server accepts forged JWTs that need only contain a valid email claim, allowing a remote unauthenticated attacker to generate arbitrary tokens and impersonate any DeviceOn account, including the root super admin. Successful exploitation permits full administrative control of the DeviceOn instance and can be leveraged to execute code on managed agents through DeviceOn’s remote management features.

Rincian

Terbit di NVD

5 Desember 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-321: Use of Hard-coded Cryptographic Key

EPSS (30 hari)

0,69% peluang dieksploitasi; lebih tinggi dari 51,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.vulncheck.com/advisories/advantech-wise-deviceon-server-hardcoded-jwt-key-authentication-bypass advisory pihak ketiga
• https://advcloudfiles.advantech.com/cms/2ca1b071-fd78-4d7f-8a2a-7b4537a95d19/Security%20Advisory%20PDF%20File/...
• https://docs.deviceon.advantech.com/docs/resource/ product
• https://pellera.com/blog/advantech-wise-deviceon-cve-2025-34256-vulnerability/