EUVD-2026-58708
GHSA-237r-96vf-c3r9
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only vector (AV:L) with specific trigger conditions (AC:H); low privilege required to initiate; scope change reflects privilege gain beyond the originating WMS process context.
Primary rating from Vendor (dell).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Incorrect Default Permission vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation.
AnalysisAI
Privilege escalation in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 enables a local low-privileged attacker to gain elevated system control by exploiting incorrectly set default permissions on files or resources managed by the WMS platform (CWE-269). The CVSS vector confirms a scope change (S:C) with full confidentiality, integrity, and availability impact, meaning a successful exploit transcends the initially compromised process context. Dell has released a fix in version 2605.0.2 via advisory DSA-2026-329; no public exploit code has been identified at time of analysis.
Technical ContextAI
Dell Wyse Management Suite (WMS) is an enterprise-grade thin client endpoint management platform used to provision, configure, and manage large fleets of Dell Wyse thin clients. The affected CPE is cpe:2.3:a:dell:wyse_management_suite_(wms):*:*:*:*:*:*:*:*. The root cause is CWE-269 (Improper Privilege Management), specifically manifesting as Incorrect Default Permissions - a subclass where the software installs or creates files, directories, service binaries, or configuration resources with overly permissive access controls. This allows lower-privileged local users to modify, replace, or inject content into resources that are subsequently loaded or executed by a higher-privileged process or service, producing unintended privilege escalation. The CVSS S:C scope change indicates the privilege gain affects components or resources outside the originally compromised WMS context, such as the underlying operating system.
RemediationAI
Upgrade Dell Wyse Management Suite to version 2605.0.2 or later, which is confirmed as the remediated release per Dell advisory DSA-2026-329 at https://www.dell.com/support/kbdoc/en-us/000493271/dsa-2026-329-security-update-for-dell-wyse-management-suite-wms-for-multiple-vulnerabilities. As a compensating control prior to patching, administrators should audit file system permissions on WMS installation and service directories, correcting any world-writable or group-writable entries to restrict access to privileged accounts only; note that overly aggressive permission changes may disrupt WMS operational workflows and should be tested in a staging environment first. Additionally, limiting local interactive login to WMS servers exclusively to named administrative accounts - and removing service or application accounts from local logon rights - reduces the attacker surface, though this may impact automated management tasks that rely on local session access.
More in Wyse Management Suite Wms
View allSQL injection in Dell Wyse Management Suite (WMS) versions prior to 2605 allows authenticated low-privileged remote atta
Authenticated SQL injection (CWE-89) in Dell Wyse Management Suite (WMS) before version 2605 lets a low-privileged remot
Local privilege-bound symlink abuse in Dell Wyse Management Suite (WMS) versions prior to 2605 allows a low-privileged l
Privilege escalation in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 allows a low-privileged local attack
Remote code execution is achievable in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 via an unrestricted f
Remote code execution in Dell Wyse Management Suite (WMS) is achievable by a high-privileged, remotely authenticated att
Hard-coded credentials in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 expose management-plane access to
Remote unauthenticated information disclosure in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 allows netw
Dell Wyse Management Suite (WMS) versions prior to 2605 ships with default credentials, enabling a high-privileged local
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today