EUVD-2026-38342
GHSA-qcx5-4hhw-rpvh
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Local access and high privilege required per description; C:H and I:H reflect full component access via default credentials despite advisory's information-disclosure framing.
Primary rating from Vendor (dell).
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionNVD
Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain a Use of Default Credentials vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.
AnalysisAI
Dell Wyse Management Suite (WMS) versions prior to 2605 ships with default credentials, enabling a high-privileged local attacker to authenticate using those credentials and access sensitive information. Reported by Dell under DSA-2026-247, the flaw is classified under CWE-1392 (Use of Default Credentials) and carries a CVSS 3.1 base score of 6.0, reflecting local-only attack surface constrained by the requirement for high privilege. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
The vulnerability resides in Dell Wyse Management Suite (WMS), an enterprise endpoint management platform used to centrally administer thin clients. The affected CPE is cpe:2.3:a:dell:wyse_management_suite_(wms):*:*:*:*:*:*:*:* covering all versions preceding WMS 2605. CWE-1392 (Use of Default Credentials) describes a class of flaw where a software product ships with pre-configured, publicly known or easily guessable credentials that are not enforced to be changed during installation or initial setup. In the context of WMS, this likely affects an internal service, database component, or administrative interface that relies on a hardcoded or default password that an attacker with local system access can leverage. The CVSS vector AV:L/AC:L/PR:H/UI:N confirms exploitation is local and requires an account with elevated privileges already established on the host.
RemediationAI
The primary remediation is to upgrade Dell Wyse Management Suite to version WMS 2605 or later, which resolves the default credentials exposure per Dell advisory DSA-2026-247 (https://www.dell.com/support/kbdoc/en-us/000472001/dsa-2026-247). Until the patch can be applied, administrators should audit WMS component configurations to identify any services or internal interfaces using default or factory-set credentials and manually rotate those credentials to strong, unique values. Access to the WMS server and its management interfaces should be restricted to authorized administrative accounts only, with host-based firewall rules or network segmentation limiting local and lateral connectivity. Monitoring privileged session activity on WMS hosts can help detect unauthorized use of default credentials as a compensating control. Note that manual credential rotation may require coordination with WMS documentation to avoid breaking internal service dependencies.
More in Wyse Management Suite Wms
View allSQL injection in Dell Wyse Management Suite (WMS) versions prior to 2605 allows authenticated low-privileged remote atta
Authenticated SQL injection (CWE-89) in Dell Wyse Management Suite (WMS) before version 2605 lets a low-privileged remot
Local privilege-bound symlink abuse in Dell Wyse Management Suite (WMS) versions prior to 2605 allows a low-privileged l
Privilege escalation in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 enables a local low-privileged attac
Privilege escalation in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 allows a low-privileged local attack
Remote code execution is achievable in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 via an unrestricted f
Remote code execution in Dell Wyse Management Suite (WMS) is achievable by a high-privileged, remotely authenticated att
Hard-coded credentials in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 expose management-plane access to
Remote unauthenticated information disclosure in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 allows netw
Same weakness CWE-1392 – Use of Default Credentials
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today