CVE-2025-34256 is a critical vulnerability in Advantech WISE-DeviceOn Server versions before 5.4 caused by the use of a hard-coded cryptographic key (CWE-321). The product uses a static HS512 HMAC secret key for signing EIRMMToken JWTs across all installations. Because the key is hard-coded and static, attackers can forge JWTs by including only a valid email claim, bypassing authentication. This flaw allows remote unauthenticated attackers to impersonate any user, including the root super admin, gaining full administrative privileges. With these privileges, attackers can execute arbitrary code on managed agents through the server’s remote management capabilities. The CVSS 4.0 base score is 10.0, reflecting the vulnerability's critical impact and ease of exploitation.

Successful exploitation allows remote unauthenticated attackers to fully compromise the WISE-DeviceOn Server by impersonating any user account, including the highest privileged root super admin. This leads to complete administrative control over the DeviceOn instance and enables remote code execution on managed agents. The vulnerability severely compromises confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Advantech’s advisories for updates. Until a fix is available, restrict access to the WISE-DeviceOn Server to trusted networks and consider additional compensating controls to limit exposure. Avoid deploying vulnerable versions in untrusted environments.