CVE-2009-0695

2022-10-0316:24:10

CWE-287

[email protected]

web.nvd.nist.gov

cve-2009-0695

wyse device manager

wdm 4.7.x

authentication bypass

remote attack

management access

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

6.7 Medium

AI Score

Confidence

Low

0.741 High

EPSS

Percentile

98.1%

JSON

hagent.exe in Wyse Device Manager (WDM) 4.7.x does not require authentication for commands, which allows remote attackers to obtain management access via a crafted query, as demonstrated by a V52 query that triggers a power-off action.

Affected configurations

NVD

Node

dellwyse_device_managerMatch4.7.0

dellwyse_device_managerMatch4.7.1

dellwyse_device_managerMatch4.7.2

CPENameOperatorVersion
dell:wyse_device_managerdell wyse device managereq4.7.0
dell:wyse_device_managerdell wyse device managereq4.7.1
dell:wyse_device_managerdell wyse device managereq4.7.2

CPE	Name	Operator	Version
dell:wyse_device_manager	dell wyse device manager	eq	4.7.0
dell:wyse_device_manager	dell wyse device manager	eq	4.7.1
dell:wyse_device_manager	dell wyse device manager	eq	4.7.2