CVE-2009-0695

2012-06-1920:55:02

CWE-287

certcc

web.nvd.nist.gov

cve-2009-0695

wyse device manager

wdm 4.7.x

authentication bypass

remote attack

management access

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

6.7

Confidence

Low

EPSS

0.637

Percentile

97.9%

JSON

hagent.exe in Wyse Device Manager (WDM) 4.7.x does not require authentication for commands, which allows remote attackers to obtain management access via a crafted query, as demonstrated by a V52 query that triggers a power-off action.

Affected configurations

Nvd

Node

dellwyse_device_managerMatch4.7.0

dellwyse_device_managerMatch4.7.1

dellwyse_device_managerMatch4.7.2

VendorProductVersionCPE
dellwyse_device_manager4.7.0cpe:2.3:a:dell:wyse_device_manager:4.7.0:*:*:*:*:*:*:*
dellwyse_device_manager4.7.1cpe:2.3:a:dell:wyse_device_manager:4.7.1:*:*:*:*:*:*:*
dellwyse_device_manager4.7.2cpe:2.3:a:dell:wyse_device_manager:4.7.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dell	wyse_device_manager	4.7.0	cpe:2.3:a:dell:wyse_device_manager:4.7.0:::::::*
dell	wyse_device_manager	4.7.1	cpe:2.3:a:dell:wyse_device_manager:4.7.1:::::::*
dell	wyse_device_manager	4.7.2	cpe:2.3:a:dell:wyse_device_manager:4.7.2:::::::*