EUVD-2026-58681
GHSA-fj4j-v552-39m3
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local vector and low privilege match description; high complexity reflects credential discovery effort; no availability impact stated.
Primary rating from Vendor (dell).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Use of Hard-coded Credentials vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.
AnalysisAI
Hard-coded credentials in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 expose management-plane access to any low-privileged local user who discovers them. Exploitation yields high confidentiality and integrity impact - an attacker can read sensitive management data and alter system state - while availability is unaffected. No public exploit code or CISA KEV listing exists at time of analysis, but the CWE-798 class is historically trivial to exploit once credentials are extracted from binaries or configuration files.
Technical ContextAI
Dell Wyse Management Suite is an enterprise endpoint management platform for thin-client fleets, identified by CPE cpe:2.3:a:dell:wyse_management_suite_(wms):*:*:*:*:*:*:*:*. CWE-798 (Use of Hard-coded Credentials) indicates that static credentials are compiled into or shipped with the software - discoverable by reverse engineering binaries, reading configuration files, or consulting public firmware dumps. In the context of a management suite, hard-coded credentials typically target internal service accounts, database connections, or inter-component APIs, making them useful for lateral movement or privilege escalation within the WMS management plane rather than providing immediate OS-level root access.
RemediationAI
The primary fix is to upgrade Dell Wyse Management Suite to version 2605.0.2 or later, as detailed in Dell advisory DSA-2026-329 at https://www.dell.com/support/kbdoc/en-us/000493271/dsa-2026-329-security-update-for-dell-wyse-management-suite-wms-for-multiple-vulnerabilities. If immediate patching is not possible, restrict local interactive and remote desktop access to the WMS server to only those administrator accounts that require it - this mitigates the PR:L requirement by reducing the pool of users who can attempt exploitation, though it does not eliminate the embedded credentials. Audit local user accounts on WMS hosts and remove unnecessary low-privileged accounts. Network-segment the WMS server so that lateral movement from compromised endpoints to the management host requires crossing a monitored boundary. These compensating controls reduce exposure but do not remove the hard-coded credential, so patching remains the definitive remediation.
More in Wyse Management Suite Wms
View allSQL injection in Dell Wyse Management Suite (WMS) versions prior to 2605 allows authenticated low-privileged remote atta
Authenticated SQL injection (CWE-89) in Dell Wyse Management Suite (WMS) before version 2605 lets a low-privileged remot
Local privilege-bound symlink abuse in Dell Wyse Management Suite (WMS) versions prior to 2605 allows a low-privileged l
Privilege escalation in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 enables a local low-privileged attac
Privilege escalation in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 allows a low-privileged local attack
Remote code execution is achievable in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 via an unrestricted f
Remote code execution in Dell Wyse Management Suite (WMS) is achievable by a high-privileged, remotely authenticated att
Remote unauthenticated information disclosure in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 allows netw
Dell Wyse Management Suite (WMS) versions prior to 2605 ships with default credentials, enabling a high-privileged local
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today