CVE-2025-34258 is a stored cross-site scripting (XSS) vulnerability affecting Advantech WISE-DeviceOn Server versions prior to 5.4. The issue exists in the /rmm/v1/devicemap/plan endpoint where the 'name' parameter of an area added to a map entry is stored and later rendered without proper HTML sanitization. This improper neutralization of input (CWE-79) allows an attacker with authenticated access to inject malicious scripts that execute in the browsers of other users interacting with the affected map entries.

Successful exploitation can lead to execution of arbitrary scripts in the context of affected users' browsers, potentially resulting in session hijacking and unauthorized actions performed with the victim's privileges. The vulnerability requires authenticated access and user interaction to trigger the malicious script execution. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low complexity, and limited confidentiality and integrity impact.

No official patch or fix is currently confirmed for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to trusted users only and avoid interacting with untrusted map entries. Monitor vendor communications for updates regarding patches or official mitigations.