PT-2020-17178 · Dell · Dell Wyse Thinos

Elad Luz + 1 · Published 2020-12-21 · Updated 2021-01-08 · CVE-2020-29491

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell Wyse ThinOS versions 8.6 and prior

Description The issue is related to an insecure default configuration, which could be exploited by a remote unauthenticated attacker to gain access to sensitive information on the local network. This could lead to the potential compromise of impacted thin clients.

Recommendations For Dell Wyse ThinOS versions 8.6 and prior, update the configuration to a secure setting to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2020-29491

Affected Products

Dell Wyse Thinos

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-29491 · Security Note
• https://dell.com/support/kbdoc/en-us/000180768/dsa-2020-281 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-29491 · Vendor Advisory
• https://t.me/thehackernews/949 · Telegram Post
• https://t.me/cibsecurity/21563 · Telegram Post