CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Lifecycle Timeline
6DescriptionNVD
Dell Wyse Management Suite, versions prior to WMS 5.2, contain an Absolute Path Traversal vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Unauthorized access.
AnalysisAI
Dell Wyse Management Suite versions prior to 5.2 contain an Absolute Path Traversal vulnerability (CWE-36) that allows unauthenticated remote attackers to read arbitrary files and gain unauthorized access without user interaction. The CVSS 8.2 score reflects high confidentiality impact and low integrity impact, with network-based attack vector requiring no privileges or interaction. No KEV/CISA active exploitation data, EPSS score, or public POC is currently confirmed in available intelligence, but the unauthenticated remote nature and path traversal primitive warrant immediate patching.
Technical ContextAI
Absolute Path Traversal (CWE-36) occurs when an application fails to properly validate or sanitize file path inputs, allowing attackers to reference files outside intended directories using absolute paths (e.g., /etc/passwd on Unix systems). In Dell Wyse Management Suite—a remote management platform for Wyse thin client devices—the vulnerability likely exists in a web interface, API endpoint, or file serving mechanism that constructs file paths from user input without validation. The affected technology stack typically involves HTTP-based management interfaces common to Dell enterprise thin-client solutions. CPE designation would be 'cpe:2.3:a:dell:wyse_management_suite:*:*:*:*:*:*:*:*' with vulnerable versions <5.2.
RemediationAI
patch: Upgrade Dell Wyse Management Suite to version 5.2 or later; priority: critical; details: Apply the latest security patch from Dell's support portal. Organizations should test patches in non-production environments before enterprise deployment to ensure compatibility with existing thin-client configurations. workaround: Network segmentation and access control; details: If immediate patching is not feasible, restrict network access to the Wyse Management Suite administrative interfaces using firewall rules, WAF policies, or network segmentation. Limit access to trusted administrative networks only. detection: Monitor and log file access patterns; details: Enable detailed logging on the WMS application and underlying OS. Search for suspicious path traversal patterns in logs (e.g., sequences containing '../', absolute paths, or unusual file requests). Monitor for unexpected file access attempts to sensitive locations (/etc, /proc, application config directories). mitigation: Principle of least privilege for service accounts; details: Ensure the Wyse Management Suite application runs with minimal file system permissions, limiting the scope of files accessible via path traversal exploitation.
More from same product – last 7 days
Open redirect vulnerability in Dell PowerFlex Manager 4.6.2 and prior enables unauthenticated remote attackers to craft
Dell PowerFlex Manager versions 4.6.2 and earlier improperly store sensitive information in a manner accessible to low-p
Incorrect Privilege Assignment in Dell PowerFlex Manager version 4.6.2 and earlier (both Appliance and Rack form factors
Directory listing exposure in Dell PowerFlex Manager versions 4.6.2 and earlier allows an attacker to enumerate director
Improper certificate validation in Dell PowerFlex Manager version 4.6.2 and earlier allows an unauthenticated attacker o
Share
External POC / Exploit Code
Leaving vuln.today
EUVD-2025-17754