EUVD-2026-58707
GHSA-v57h-w57g-fgm7
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network vector confirmed by remote access requirement; PR:H because exploitation mandates administrative credentials per the description; full C/I/A impact from arbitrary code execution on the server.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
3DescriptionCVE.org
Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution.
AnalysisAI
Remote code execution is achievable in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 via an unrestricted file upload vulnerability (CWE-434). A high-privileged remote attacker can upload a file with a dangerous type - such as a web shell or server-side script - to the WMS server, resulting in full code execution with the application's privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and direct RCE impact make patching a priority for organizations running WMS.
Technical ContextAI
Dell Wyse Management Suite (WMS) is an enterprise thin-client management platform used to centrally provision, configure, and manage Dell Wyse endpoints at scale. The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), a class of flaw where a web application accepts file uploads without adequately validating or restricting the file type, extension, or content. An attacker with administrative access to the WMS web interface can upload a file with a server-executable extension (e.g., .jsp, .php, .aspx, or equivalent for the underlying application server), which, when accessed via HTTP, causes the server to interpret and execute the payload. The affected CPE string cpe:2.3:a:dell:wyse_management_suite_(wms):*:*:*:*:*:*:*:* covers all versions prior to 2605.0.2.
RemediationAI
Upgrade Dell Wyse Management Suite to version 2605.0.2 or later, as documented in Dell security advisory DSA-2026-329 (https://www.dell.com/support/kbdoc/en-us/000493271/dsa-2026-329-security-update-for-dell-wyse-management-suite-wms-for-multiple-vulnerabilities). This is the primary and recommended fix. As a compensating control prior to patching, restrict network access to the WMS administrative interface using firewall rules or network ACLs so that only authorized management workstations on trusted network segments can reach the console - this reduces the effective attack surface given the PR:H requirement. Additionally, enforce the principle of least privilege: audit which accounts hold WMS administrative roles and revoke unnecessary elevated access, since exploitation requires high-privileged credentials. Enabling multi-factor authentication (MFA) on WMS admin accounts would further raise the bar for credential-based attacks. These controls should be treated as temporary measures only; patching to 2605.0.2 remains the definitive remediation.
More in Wyse Management Suite Wms
View allSQL injection in Dell Wyse Management Suite (WMS) versions prior to 2605 allows authenticated low-privileged remote atta
Authenticated SQL injection (CWE-89) in Dell Wyse Management Suite (WMS) before version 2605 lets a low-privileged remot
Local privilege-bound symlink abuse in Dell Wyse Management Suite (WMS) versions prior to 2605 allows a low-privileged l
Privilege escalation in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 enables a local low-privileged attac
Privilege escalation in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 allows a low-privileged local attack
Remote code execution in Dell Wyse Management Suite (WMS) is achievable by a high-privileged, remotely authenticated att
Hard-coded credentials in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 expose management-plane access to
Remote unauthenticated information disclosure in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 allows netw
Dell Wyse Management Suite (WMS) versions prior to 2605 ships with default credentials, enabling a high-privileged local
Share
External POC / Exploit Code
Leaving vuln.today