CVE-2025-34261 is a stored XSS vulnerability in Advantech WISE-DeviceOn Server prior to version 5.4. The vulnerability exists because the application does not properly sanitize HTML in the name and description fields of device groups created via the /rmm/v1/devicegroups/ endpoint. An attacker with authenticated access can inject malicious scripts that execute in the context of other users viewing these device groups, enabling potential session hijacking or unauthorized actions.

Exploitation of this vulnerability allows an authenticated attacker to execute arbitrary scripts in the browsers of other users who view or interact with the affected device groups. This can lead to session compromise and unauthorized actions performed with the victim's privileges. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low attack complexity, and limited scope and impact.

No official patch or fix is currently documented for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to trusted users only and avoid viewing or interacting with untrusted device group entries. Monitor vendor communications for updates on patches or mitigations.