EUVD-2026-38345
GHSA-jrhr-xpg4-wphg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable SQLi exploitable by an authenticated low-privilege user without interaction (PR:L, UI:N, AC:L); database read/write yields High C/I/A with unchanged scope.
Primary rating from Vendor (dell).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
AnalysisAI
Authenticated SQL injection (CWE-89) in Dell Wyse Management Suite (WMS) before version 2605 lets a low-privileged remote user inject crafted SQL into application queries, yielding unauthorized read/write access to the management database with high impact to confidentiality, integrity, and availability. Tracked as EUVD-2026-38345 and disclosed by Dell in advisory DSA-2026-247, it carries CVSS 3.1 8.8 but has no public exploit identified at time of analysis and a low EPSS of 0.24% (15th percentile), with CISA SSVC reporting no known exploitation.
Technical ContextAI
Wyse Management Suite is Dell's centralized console for provisioning, configuring, and monitoring Wyse/ThinOS thin clients and endpoints across an enterprise. The root cause is CWE-89, Improper Neutralization of Special Elements used in an SQL Command: user-supplied input reaches a backend SQL query without adequate parameterization or escaping, allowing an attacker to alter query logic. The single CPE provided, cpe:2.3:a:dell:wyse_management_suite_(wms):*, identifies the affected component as the WMS application itself; because WMS stores device inventory, policies, and credentials in its database, SQL injection here can expose or tamper with the data that governs the managed fleet. The 'Authentication Bypass' tag combined with the SQLi class suggests the injection point sits behind only a low-privilege authentication boundary that can be abused to reach data or actions beyond the attacker's intended role.
RemediationAI
Upgrade to Dell Wyse Management Suite version 2605 or later, the vendor-released fix referenced in Dell advisory DSA-2026-247 (https://www.dell.com/support/kbdoc/en-us/000472001/dsa-2026-247); follow Dell's documented upgrade path and validate the management database after upgrade. Until patching, reduce exposure by restricting network reachability of the WMS console and its API/database to a trusted management VLAN or VPN so low-privilege remote users cannot reach the injection surface, and tighten WMS account provisioning to minimize the number of low-privilege accounts that could be abused (trade-off: tighter network and account controls may disrupt remote admins and automated integrations that legitimately reach WMS). Monitor WMS application and database logs for anomalous query patterns or authentication from unexpected sources as a detective control. These are compensating controls only; applying the 2605 update is the durable fix.
More in Wyse Management Suite Wms
View allSQL injection in Dell Wyse Management Suite (WMS) versions prior to 2605 allows authenticated low-privileged remote atta
Local privilege-bound symlink abuse in Dell Wyse Management Suite (WMS) versions prior to 2605 allows a low-privileged l
Privilege escalation in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 enables a local low-privileged attac
Privilege escalation in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 allows a low-privileged local attack
Remote code execution is achievable in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 via an unrestricted f
Remote code execution in Dell Wyse Management Suite (WMS) is achievable by a high-privileged, remotely authenticated att
Hard-coded credentials in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 expose management-plane access to
Remote unauthenticated information disclosure in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 allows netw
Dell Wyse Management Suite (WMS) versions prior to 2605 ships with default credentials, enabling a high-privileged local
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today