sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2025-34256 Advantech WISE-DeviceOn Server < 5.4 Hard-coded JWT Key Authentication Bypass

Critical 10.0 Published Updated

Remote attackers can bypass authentication using a hard-coded JWT key to impersonate any user, including admins, and execute code on managed devices.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Over the internet
Victim action needed
Not needed
Fix
None listed

What is CVE-2025-34256?

CVE-2025-34256 is a critical vulnerability in Advantech Co., Ltd. WISE-DeviceOn Server, published on 5 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Advantech WISE-DeviceOn Server versions prior to 5.4 contain a hard-coded cryptographic key vulnerability. The product uses a static HS512 HMAC secret for signing EIRMMToken JWTs across all installations. The server accepts forged JWTs that need only contain a valid email claim, allowing a remote unauthenticated attacker to generate arbitrary tokens and impersonate any DeviceOn account, including the root super admin. Successful exploitation permits full administrative control of the DeviceOn instance and can be leveraged to execute code on managed agents through DeviceOn’s remote management features.

Weakness: CWE-321

Which versions are affected by CVE-2025-34256?

It affects 1 product.

Products include Advantech Wise-Deviceon Server.

How do I fix CVE-2025-34256?

No fix has been published for CVE-2025-34256 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-34256 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-34256 exists.

Sources

Also known as GHSA-vqjp-fh8j-rf3j.

Is CVE-2025-34256 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free