Wyse Management Suite CVE-2025-36574

CVSS 8.2 (AV:N/AC:L/PR:N/UI:N) indicates critical exploitability: network-accessible, low attack complexity, no authentication required, no user interaction needed. This is a high-fidelity signal of real risk. However, without confirmed KEV/CISA active exploitation status, public POC, or reported EPSS score, real-world exploitation probability cannot be definitively quantified. The vulnerability's criticality is amplified by Wyse Management Suite's role in enterprise infrastructure—compromise enables lateral movement within thin-client deployments and access to centralized management credentials/configuration. SSVC perspective: if unpatched in production environments, exploitation is likely automatable (path traversal is straightforward) with substantial technical impact (credential/config disclosure). This should be treated as a high-priority patch candidate for any organization running Wyse infrastructure, even absent active exploitation evidence.

An attacker on the network (or internet-accessible WMS instance) sends a crafted HTTP request to the management interface, supplying an absolute file path in a vulnerable parameter (e.g., a file download/export endpoint). The application fails to validate the path and returns the contents of arbitrary files such as /etc/passwd, application configuration files containing database credentials, or SSL certificates. The attacker uses disclosed credentials to authenticate to the underlying thin-client infrastructure or exfiltrate sensitive organizational data. If WMS is internet-facing (common in remote management scenarios), exploitation requires only the ability to send HTTP requests—no special tools or authentication. A proof-of-concept would likely involve fuzzing file endpoints with traversal payloads (e.g., GET /api/export?file=/etc/passwd) to confirm path traversal behavior.