CVE-2025-34256 is a critical (CVSS 9.8) hard-coded cryptographic key in Advantech WISE-DeviceOn Server before version 5.4. The same signing secret protects tokens on every install, so forged tokens work. Upgrade to 5.4 or later, then review administrator accounts and sessions.
What's affected
The record says Advantech WISE-DeviceOn Server versions prior to 5.4 are affected. Pellera tested WISE-DeviceOn 5.3.12 and found 11 vulnerabilities, including this one, and says Advantech supplied a patched version that it confirmed on 4 November 2025. The Pellera post does not give the patched version number, so use the Advantech security advisory dated 8 December 2025 and the DeviceOn resource page to confirm the release to install.
The record does not say whether versions before 5.3.12 are affected, so treat all builds before 5.4 as in range.
How to check if you're exposed
Sign in to the DeviceOn server console and read the product version. Anything below 5.4 is in range.
Check exposure too. The server should not sit open on the internet unless it must. Review firewall rules and reverse proxy settings for the server address.
Then review account activity. Look at the list of administrator and super admin accounts, and at recent sessions, for logins you cannot match to a person. Review the audit trail for remote management actions sent to agents.
The open source dependencies of your own applications can be checked in a free scan, but this server is shipped software, so use your inventory to find it.
What to do now
- Find every DeviceOn server and note its version.
- Upgrade to 5.4 or later, confirming the exact build in the Advantech advisory.
- Limit access to the server to trusted networks or a VPN.
- Review administrator accounts, sessions and remote management activity for anything unexpected.
- Rotate secrets and credentials held by the server after the upgrade.
- Check managed agents for unplanned commands or software changes.
Why it matters
The weakness is CWE-321, use of a hard-coded cryptographic key. The record says the server signs its EIRMMToken tokens with one static HS512 secret that is the same in every installation. Anyone who learns it can mint a valid token that need only carry a valid email claim, and can impersonate any account, including the root super admin.
A shared secret baked into software turns one disclosure into a break of every customer. Keys must be generated per install and stored outside the code. The record says successful use gives full administrative control and can be used to run code on managed agents through remote management, so the blast radius reaches your devices. The CVE is not flagged as exploited in the record or on the CISA KEV list.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes this CVE?
The record says versions before 5.4 are affected, so use 5.4 or later and confirm the build in the Advantech advisory.
Why is a hard-coded key so serious?
Every installation shares it, so one leaked key lets an attacker forge tokens for any of them.
Sources
Last reviewed: 18 October 2026.
