Home

Description

Advantech WISE-DeviceOn Server versions prior to 5.4 contain a hard-coded cryptographic key vulnerability. The product uses a static HS512 HMAC secret for signing EIRMMToken JWTs across all installations. The server accepts forged JWTs that need only contain a valid email claim, allowing a remote unauthenticated attacker to generate arbitrary tokens and impersonate any DeviceOn account, including the root super admin. Successful exploitation permits full administrative control of the DeviceOn instance and can be leveraged to execute code on managed agents through DeviceOn’s remote management features.

PUBLISHED Reserved 2025-04-15 | Published 2025-12-05 | Updated 2025-12-05 | Assigner VulnCheck




CRITICAL: 10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Problem types

CWE-321 Use of Hard-coded Cryptographic Key

Product status

Default status
unaffected

Any version before 5.4
affected

Credits

Alex Williams from Pellera Technologies finder

References

advcloudfiles.advantech.com/...RITY-ADVISORY----DeviceOn.pdf vendor-advisory patch

docs.deviceon.advantech.com/docs/resource/ product

www.vulncheck.com/...hardcoded-jwt-key-authentication-bypass third-party-advisory

cve.org (CVE-2025-34256)

nvd.nist.gov (CVE-2025-34256)