Critical · published December 5, 2025
🚨 A hard-coded cryptographic key! With Advantech WISE-DeviceOn Server versions before 5.4, it’s mind-blowingly simple for attackers to impersonate any user — including the root admin! 🔥 Think of this as a hotel where every guest has the same key to every room — any intruder can wander in, overturn furniture, and take control of your vacation! 🏨 This vulnerability allows an attacker to generate forged JWTs just by providing a valid email, granting them full administrative control over the DeviceOn instance. They could execute code and manipulate managed devices at will, leading to devastating consequences for your entire network. The potential for data breaches and unauthorized access is absolutely staggering!
Think of this as a hotel where every guest has the same key to every room — any intruder can wander in, overturn furniture, and take control of your vacation! 🏨 The vulnerability stems from the use of a static HS512 HMAC secret for signing EIRMMToken JWTs, allowing unauthenticated remote attackers to impersonate users by creating arbitrary tokens with only a valid email claim.
This vulnerability allows an attacker to generate forged JWTs just by providing a valid email, granting them full administrative control over the DeviceOn instance. They could execute code and manipulate managed devices at will, leading to devastating consequences for your entire network. The potential for data breaches and unauthorized access is absolutely staggering! To secure your systems, patch to version 5.4 or later immediately. Additionally, consider rotating any cryptographic keys and implementing stricter validation on JWT claims. Regularly audit user permissions and access controls to mitigate future risks. You can fix this! Follow these steps to tighten your security and keep the bad guys out! 🛡️