CVE-2025-34260 is a stored cross-site scripting (XSS) vulnerability in Advantech WISE-DeviceOn Server prior to version 5.4. The issue occurs because the schedule name input at the /rmm/v1/action/schedule endpoint is stored and later rendered without proper HTML sanitization. An attacker with authenticated access can inject malicious JavaScript code into the schedule name, which executes in the context of users who view or interact with the schedule, potentially enabling session hijacking or unauthorized actions. The CVSS 4.0 vector indicates network attack vector, low attack complexity, low privileges required, and user interaction needed.

Successful exploitation allows an authenticated attacker to execute arbitrary scripts in the browsers of users who view the affected schedule listings. This can lead to session compromise and unauthorized actions performed with the victim's privileges. The impact is limited by the requirement for attacker authentication and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to trusted users only and avoid interacting with untrusted schedule entries. Monitor vendor communications for patches or updates addressing this vulnerability.