EUVD-2026-78906
GHSA-83px-mr8w-2p8f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Primary rating from Vendor (dell) · only source for this CVE.
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
AnalysisAI
Unauthenticated remote attackers can upload files of dangerous type to Dell Wyse Management Suite deployments running versions prior to 2605.0.3.683, because the console fails to restrict uploaded file types (CWE-434), which allows a crafted payload such as a web shell to be placed and executed on the server. The flaw carries a CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N), meaning no credentials or user interaction are required — only network reachability to the WMS web interface. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wyse Management Suite
View allRemote code execution affects Dell Wyse Management Suite in all versions prior to WMS 5.5 HF1, stemming from the applica
Wyse Management Suite 3.3.1 and below versions contain a deserialization vulnerability that could allow an unauthenticat
Dell Wyse Management Suite versions prior to 5.5 suffer from improper access controls that allow authenticated remote at
Dell Wyse Management Suite 3.6.1 and below contains an Plain-text Password Storage Vulnerability in UI. Rated high sever
Unauthenticated remote code execution affects Dell Wyse Management Suite deployments running any version prior to 2605.0
Unauthenticated remote code execution in Dell Wyse Management Suite (WMS) lets any remote attacker who can reach the man
Dell Wyse Management Suite versions prior to 5.2 contain an Absolute Path Traversal vulnerability (CWE-36) that allows u
Information tampering in Dell Wyse Management Suite (WMS) releases prior to 2605.0.3.683 is possible because the console
Dell WMS versions 1.1 and prior are impacted by multiple unquoted service path vulnerabilities. Rated high severity (CVS
Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Exposure of Sensitive Information Through Data Querie
A information disclosure vulnerability in an Exposure of Sensitive Information (CVSS 7.5). High severity vulnerability r
Missing authentication for a critical function in Dell Wyse Management Suite (WMS) releases prior to 2605.0.3.683 allows
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today