DSA-2025-226: Security Update for Dell Wyse Management Suite (WMS) for Multiple Vulnerabilities
Summary: Dell Wyse Management Suite (WMS) remediation is available for multiple vulnerabilities that could be exploited by malicious users to compromise the affected system.
Impact
High
Details
|
Third-party Component |
CVEs |
More Information |
|
EMSDK |
CVE-2024-6763, CVE-2024-8184 |
|
Proprietary Code CVEs |
Description |
CVSS Base Score |
CVSS Vector String |
|
CVE-2025-36574 |
Dell Wyse Management Suite, versions prior to WMS 5.2, contain an Absolute Path Traversal vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Unauthorized access. |
8.2 |
|
|
CVE-2025-36575 |
Dell Wyse Management Suite, versions prior to WMS 5.2, contain an Exposure of Sensitive Information Through Data Queries vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure. |
7.5
|
|
|
CVE-2025-36578 |
Dell Wyse Management Suite, versions prior to WMS 5.2, contain an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access. |
6.8 |
|
|
CVE-2025-36580 |
Dell Wyse Management Suite, versions prior to WMS 5.2, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection. |
6.1 |
|
|
CVE-2025-36577 |
Dell Wyse Management Suite, versions prior to WMS 5.2, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection. |
6.1 |
|
|
CVE-2025-36576 |
Dell Wyse Management Suite, versions prior to WMS 5.2, contain a Cross-Site Request Forgery (CSRF) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery. |
2.7 |
|
Proprietary Code CVEs |
Description |
CVSS Base Score |
CVSS Vector String |
|
CVE-2025-36574 |
Dell Wyse Management Suite, versions prior to WMS 5.2, contain an Absolute Path Traversal vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Unauthorized access. |
8.2 |
|
|
CVE-2025-36575 |
Dell Wyse Management Suite, versions prior to WMS 5.2, contain an Exposure of Sensitive Information Through Data Queries vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure. |
7.5
|
|
|
CVE-2025-36578 |
Dell Wyse Management Suite, versions prior to WMS 5.2, contain an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access. |
6.8 |
|
|
CVE-2025-36580 |
Dell Wyse Management Suite, versions prior to WMS 5.2, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection. |
6.1 |
|
|
CVE-2025-36577 |
Dell Wyse Management Suite, versions prior to WMS 5.2, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection. |
6.1 |
|
|
CVE-2025-36576 |
Dell Wyse Management Suite, versions prior to WMS 5.2, contain a Cross-Site Request Forgery (CSRF) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery. |
2.7 |
Επηρεαζόμενα προϊόντα και αποκατάσταση
|
CVEs addressed |
Product |
Affected Versions |
Remediated Versions |
Release Date |
Link |
|
CVE-2024-6763, CVE-2024-8184, CVE-2025-36574, CVE-2025-36575, CVE-2025-36578, CVE-2025-36580, CVE-2025-36577, CVE-2025-36576 |
Dell Wyse Management Suite |
Versions prior to 5.2 |
Version 5.2 or later |
06/02/2025 |
|
CVEs addressed |
Product |
Affected Versions |
Remediated Versions |
Release Date |
Link |
|
CVE-2024-6763, CVE-2024-8184, CVE-2025-36574, CVE-2025-36575, CVE-2025-36578, CVE-2025-36580, CVE-2025-36577, CVE-2025-36576 |
Dell Wyse Management Suite |
Versions prior to 5.2 |
Version 5.2 or later |
06/02/2025 |
Revision History
|
Revision |
Date |
Description |
|
1.0 |
2025-06-10 |
Initial Release |
Acknowledgements
CVE-2025-36574, CVE-2025-36575: Dell would like to thank Justin Hocquel NCIA/NCSC Researcher for reporting this issue.