CVE-2025-34262 is a stored cross-site scripting (XSS) vulnerability in Advantech WISE-DeviceOn Server versions prior to 5.4. The flaw exists in the /rmm/v1/devices/name/{agent_id} endpoint, where an authenticated user can rename a device with a crafted new_name value containing malicious script. This script is stored and subsequently rendered in device listings or detail views without proper HTML sanitization, enabling script execution in the browsers of users who view or interact with the device. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Successful exploitation allows an attacker with authenticated access to inject malicious scripts into device names. These scripts execute in the browser context of other users viewing the device, potentially leading to session hijacking or unauthorized actions performed on behalf of the victim user. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low complexity, and limited user interaction required.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict device renaming privileges to trusted users only and avoid viewing device names from untrusted sources. Implement additional input validation or output encoding on the server side if possible.