CVE-2025-34259 is a stored cross-site scripting (XSS) vulnerability in Advantech WISE-DeviceOn Server versions prior to 5.4. The vulnerability exists in the /rmm/v1/devicemap/building endpoint where the name parameter of a map entry is stored without proper HTML sanitization. When other users view or interact with the map list UI, the malicious script executes in their browser context. This vulnerability requires authenticated access to create the malicious map entry and can lead to session compromise and unauthorized actions performed as the victim user.

An attacker with authenticated access can inject malicious scripts that execute in the browsers of other users viewing the affected map entries. This can result in session hijacking and unauthorized actions performed with the victim's privileges. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.1, reflecting network attack vector, low complexity, and limited scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to trusted users only and avoid interacting with untrusted map entries. Monitor vendor communications for updates regarding patches or official mitigations.