Advantech WISE‑DeviceOn Server versions before 5.4 contain a hard‑coded HS512 HMAC secret that signs all EIRMMToken JWTs. Because the server accepts JWTs that contain only a valid email claim, a remote unauthenticated attacker can forge a token for any account, including the super admin. The attacker then obtains full administrative control of the DeviceOn instance and can use the server’s remote management features to execute code on managed agents. The vulnerability is a CWE‑321 weakness related to hard‑coded cryptographic keys, compromising both confidentiality and integrity of authentication tokens.

Advantech Company Ltd. – WISE‑DeviceOn Server; all installations running any version older than 5.4 are affected. No specific patch version is listed, but the fix requires upgrading to at least version 5.4 or applying the vendor’s latest security update.

The CVSS score of 10 indicates critical severity, while the EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, indicating that active exploitation is currently unlikely but possible. Based on the description, the attack vector is a remote, unauthenticated network request to the device’s API that accepts forged JWTs. Once a valid token is forged, the attacker gains full administrative privileges and can run arbitrary code through remote management capabilities. Because the exploit relies solely on the hard‑coded key and the server’s lax validation, it can be performed without any credentials or local access.