CVE-2025-34256: advantech co., ltd. wise-deviceon server Use of Hard-coded Cryptographic Key
Vulnerability summary
CVE-2025-34256 is a critical (CVSS 10.0) Use of Hard-coded Cryptographic Key vulnerability in advantech co., ltd. wise-deviceon server. EPSS estimates a 0.69% chance of exploitation in the next 30 days, higher than 52.2% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 05-12-2025PublishedVulnerability first disclosed.
- 14-08-2026Last modifiedVulnerability information updated.
Description
Advantech WISE-DeviceOn Server versions prior to 5.4 contain a hard-coded cryptographic key vulnerability. The product uses a static HS512 HMAC secret for signing EIRMMToken JWTs across all installations. The server accepts forged JWTs that need only contain a valid email claim, allowing a remote unauthenticated attacker to generate arbitrary tokens and impersonate any DeviceOn account, including the root super admin. Successful exploitation permits full administrative control of the DeviceOn instance and can be leveraged to execute code on managed agents through DeviceOn’s remote management features.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST10.0CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.69%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
0.00 pp
From 0.69% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (pellera.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Advantech1 product
- wise-deviceon_server< 5.4
Advantech co., ltd.1 product
- wise-deviceon server< 5.4.0
2 vendors · 2 products