CVE-2025-34257 is a stored XSS vulnerability in Advantech WISE-DeviceOn Server prior to version 5.4. The vulnerability exists because the defined_name parameter in the /rmm/v1/action/defined endpoint is stored and later rendered on the Overview page without proper HTML sanitization. An attacker with authenticated access can inject malicious scripts that execute in the browsers of other users viewing the affected task, potentially enabling session hijacking or unauthorized actions. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low complexity, low privileges required, and partial impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated attacker to inject malicious scripts that execute in other users' browsers when they view the Overview page. This can lead to session compromise and unauthorized actions performed with the victim's privileges. The impact is limited by the requirement for attacker authentication and user interaction (viewing the task). There are no known exploits in the wild at this time.

No official patch or fix is currently documented for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user privileges to trusted users only and avoid viewing untrusted task entries. Monitor vendor channels for updates regarding patches or official mitigations.