Lucene search

DellCVE-2019-3712

HistoryMar 07, 2019 - 7:00 p.m.

CVE-2019-3712

2019-03-0719:00:00

CWE-119

dell

web.nvd.nist.gov

cve-2019-3712

dell

wes

wyse

thinlinux

hagent

buffer overflow

vulnerability

ftp

code

CVSS2

8.3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:L/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.1

Confidence

High

EPSS

0.001

Percentile

44.6%

JSON

Dell WES Wyse Device Agent versions prior to 14.1.2.9 and Dell Wyse ThinLinux HAgent versions prior to 5.4.55 00.10 contain a buffer overflow vulnerability. An unauthenticated attacker may potentially exploit this vulnerability to execute arbitrary code on the system with privileges of the FTP client by sending specially crafted input data to the affected system. The FTP code that contained the vulnerability has been removed.

Affected configurations

Nvd

Vulners

Node

dellwindows_embedded_standard_wyse_device_agentRange<14.1.2.9

dellwyse_thinlinux_hagentRange<5.4.55_00.10

VendorProductVersionCPE
dellwindows_embedded_standard_wyse_device_agent*cpe:2.3:a:dell:windows_embedded_standard_wyse_device_agent:*:*:*:*:*:*:*:*
dellwyse_thinlinux_hagent*cpe:2.3:a:dell:wyse_thinlinux_hagent:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dell	windows_embedded_standard_wyse_device_agent	*	cpe:2.3:a:dell:windows_embedded_standard_wyse_device_agent::::::::
dell	wyse_thinlinux_hagent	*	cpe:2.3:a:dell:wyse_thinlinux_hagent::::::::

CNA Affected

[
  {
    "product": "Wyse Device Agent",
    "vendor": "Dell",
    "versions": [
      {
        "lessThanOrEqual": "14.1.2.9",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Wyse ThinLinux HAgent",
    "vendor": "Dell",
    "versions": [
      {
        "lessThanOrEqual": "5.4.55 00.10",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.securityfocus.com/bid/107376

www.dell.com/support/article/us/en/19/sln316391

CVSS2

8.3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:L/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.1

Confidence

High

EPSS

0.001

Percentile

44.6%

JSON

Related for CVE-2019-3712