CVE-2025-64302 MEDIUM

CVE-2025-64302: Advantech DeviceOn/iEdge Cross-site Scripting

Vendor Advantech

Product DeviceOn/iEdge

Weakness CWE-79 · XSS

Published November 6, 2025

Last update November 7, 2025

View on NVD All CVEs

CVSS base score

6.4/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Insufficient input sanitization in the dashboard label or path can allow an attacker to trigger a device error causing information disclosure or data manipulation.

Key dates

02Disclosure timeline

November 6, 2025 CVE published

November 7, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-64302 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2021-24264 Image Hover Effects - Elementor Addon < 1.3.4 - Contributor+ Stored XSS CVE-2025-12661 Pollcaster Shortcode Plugin <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2026-0695 Stored XSS in Time Entry Audit Trail CVE-2025-9490 Popup Maker <= 1.20.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter CVE-2023-40674 WordPress Simple URLs Plugin <= 118 is vulnerable to Cross Site Scripting (XSS)