CVE-2025-34256 is a critical vulnerability in Advantech WISE-DeviceOn Server versions before 5.4 caused by the use of a hard-coded cryptographic key (CWE-321). The product uses a static HS512 HMAC secret for signing EIRMMToken JWTs across all installations. Because the server accepts forged JWTs that only require a valid email claim, a remote unauthenticated attacker can generate arbitrary tokens to impersonate any DeviceOn account, including the root super admin. This leads to full administrative control of the DeviceOn instance and can be leveraged to execute code on managed agents through DeviceOn’s remote management capabilities.

Successful exploitation allows a remote unauthenticated attacker to impersonate any user, including the root super admin, resulting in full administrative control over the DeviceOn server. This control can be used to execute arbitrary code on managed agents, severely compromising the integrity and security of the managed environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, restrict access to the DeviceOn server and monitor for suspicious JWT tokens. Avoid exposing the server to untrusted networks.