EUVD-2026-58686
GHSA-8gw5-7j87-gwqm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible unauthenticated endpoint confirmed by PR:N; impact is partial confidentiality only with no integrity or availability loss, consistent with information disclosure classification.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
AnalysisAI
Remote unauthenticated information disclosure in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 allows network-accessible attackers to access sensitive data through a critical management function lacking authentication enforcement. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no user interaction, and no special configuration - any reachable WMS instance running an unpatched version is a valid target. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis; a vendor-released patch is available.
Technical ContextAI
Dell Wyse Management Suite (WMS) is an enterprise-grade platform for centralized management of thin clients, used by organizations to provision, monitor, and control large fleets of endpoint devices. The vulnerability is catalogued under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), with the root cause rooted in CWE-306 (Missing Authentication for Critical Function) - a design flaw where one or more management API endpoints or functions do not enforce authentication before returning data. The affected CPE is cpe:2.3:a:dell:wyse_management_suite_(wms):*:*:*:*:*:*:*:* covering all WMS releases up to (but not including) version 2605.0.2. Because WMS typically handles device configurations, credentials, and inventory data, unauthenticated exposure of its internal functions carries meaningful information-leakage risk even at a limited confidentiality impact level.
RemediationAI
The primary remediation is to upgrade Dell Wyse Management Suite to version 2605.0.2 or later, which is the vendor-released patch addressing this and additional vulnerabilities per Dell advisory DSA-2026-329 (https://www.dell.com/support/kbdoc/en-us/000493271/dsa-2026-329-security-update-for-dell-wyse-management-suite-wms-for-multiple-vulnerabilities). If immediate patching is operationally blocked, restrict network access to the WMS management interface using perimeter firewall rules or network segmentation so that only trusted administrator subnets can reach WMS ports - this does not eliminate the vulnerability but substantially reduces the reachable attack surface. Organizations should also audit WMS network exposure to ensure the management console is not directly internet-facing, as the AV:N/PR:N vector means any reachable host is a valid attacker origin. Note that network restriction is a compensating control only; patching to 2605.0.2 remains the definitive fix.
More in Wyse Management Suite Wms
View allSQL injection in Dell Wyse Management Suite (WMS) versions prior to 2605 allows authenticated low-privileged remote atta
Authenticated SQL injection (CWE-89) in Dell Wyse Management Suite (WMS) before version 2605 lets a low-privileged remot
Local privilege-bound symlink abuse in Dell Wyse Management Suite (WMS) versions prior to 2605 allows a low-privileged l
Privilege escalation in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 enables a local low-privileged attac
Privilege escalation in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 allows a low-privileged local attack
Remote code execution is achievable in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 via an unrestricted f
Remote code execution in Dell Wyse Management Suite (WMS) is achievable by a high-privileged, remotely authenticated att
Hard-coded credentials in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 expose management-plane access to
Dell Wyse Management Suite (WMS) versions prior to 2605 ships with default credentials, enabling a high-privileged local
Same weakness CWE-200 – Information Exposure
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today