PT-2024-8790 · Dell · Dell Wyse Management Suite

Ahmed Y. Elmogy · Published 2024-11-25 · Updated 2024-11-26 · CVE-2024-49596

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Medium

Base vector

AV:N/AC:H/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Dell Wyse Management Suite versions WMS 4.4 and prior

Description: The issue is related to a missing authorization procedure in the hybrid cloud solution for managing thin clients. This could allow a remote attacker to cause a denial of service and delete arbitrary files. A high-privileged attacker with remote access could potentially exploit this, leading to significant system disruption.

Recommendations: For versions WMS 4.4 and prior, consider restricting remote access to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the privileges of remote users to reduce the potential impact of the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2024-10422

CVE-2024-49596

Affected Products

Dell Wyse Management Suite

References · 6

• https://osv.dev/vulnerability/CVE-2024-49596 · Vendor Advisory
• https://dell.com/support/kbdoc/en-us/000244453/dsa-2024-440 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10422 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-49596 · Security Note
• https://t.me/cvenotify/102557 · Telegram Post
• https://twitter.com/CVEnew/status/1861255976055415014 · Twitter Post