문서 번호: 000180768
Critical
| Proprietary Code CVE(s) | Description | CVSS Base Score | CVSS Vector String |
| CVE-2020-29491 | Dell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to gain access to the sensitive information on the local network, leading to the potential compromise of impacted thin clients. | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| CVE-2020-29492 | Dell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to access the writable file and manipulate the configuration of any target specific station. | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| Proprietary Code CVE(s) | Description | CVSS Base Score | CVSS Vector String |
| CVE-2020-29491 | Dell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to gain access to the sensitive information on the local network, leading to the potential compromise of impacted thin clients. | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| CVE-2020-29492 | Dell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to access the writable file and manipulate the configuration of any target specific station. | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Dell Technologies는 모든 고객이 CVSS 기본 점수와 관련 임시 및 환경 점수를 모두 고려할 것을 권장합니다. 이 경우 특정 보안 취약성과 관련된 잠재적인 심각도에 영향을 미칠 수 있습니다.
| Product | Affected Version(s) | Updated Version(s) | Link to Update |
| Dell Wyse 3040 Thin Client (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol | 8.6 MR8 | Dell Wyse 3040 Thin Client (ENG) |
| Dell Wyse 3040 Thin Client (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 3040 Thin Client (JPN) |
| Dell Wyse 3040 Thin Client with PCoIP (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 3040 Thin Client with PCoIP (ENG) |
| Dell Wyse 3040 Thin Client with PCoIP (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 3040 Thin Client with PCoIP (JPN) |
| Dell Wyse 5010 Thin Client (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol | 8.6 MR8 | Dell Wyse 5010 Thin Client (ENG) |
| Dell Wyse 5010 Thin Client (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol | 8.6 MR8 | Dell Wyse 5010 Thin Client (JPN) |
| Dell Wyse 5010 Thin Client with PCoIP (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 5010 Thin Client with PCoIP (ENG) |
| Dell Wyse 5010 Thin Client with PCoIP (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 5010 Thin Client with PCoIP (JPN) |
| Dell Wyse 5040 Thin Client (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol | 8.6 MR8 | Dell Wyse 5040 Thin Client (ENG) |
| Dell Wyse 5040 Thin Client (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol | 8.6 MR8 | Dell Wyse 5040 Thin Client (JPN) |
| Dell Wyse 5040 Thin Client with PCoIP (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 5040 Thin Client with PCoIP (ENG) |
| Dell Wyse 5040 Thin Client with PCoIP (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 5040 Thin Client with PCoIP (JPN) |
| Dell Wyse 5060 Thin Client (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 5060 Thin Client (ENG) |
| Dell Wyse 5060 Thin Client (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol | 8.6 MR8 | Dell Wyse 5060 Thin Client (JPN) |
| Dell Wyse 5060 Thin Client with PCoIP (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 5060 Thin Client with PCoIP (ENG) |
| Dell Wyse 5060 Thin Client with PCoIP (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 5060 Thin Client with PCoIP (JPN) |
| Dell Wyse 5070 Thin Client (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol | 8.6 MR8 | Dell Wyse 5070 Thin Client (ENG) |
| Dell Wyse 5070 Thin Client (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol | 8.6 MR8 | Dell Wyse 5070 Thin Client (JPN) |
| Dell Wyse 5070 Thin Client with PCoIP (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 5070 Thin Client with PCoIP (ENG) |
| Dell Wyse 5070 Thin Client with PCoIP (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 5070 Thin Client with PCoIP (JPN) |
| Dell Wyse 5470 AIO Thin Client (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 5470 AIO Thin Client (ENG) |
| Dell Wyse 5470 AIO Thin Client (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 5470 AIO Thin Client (JPN) |
| Dell Wyse 5470 AIO Thin Client with PCoIP (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 5470 AIO Thin Client with PCoIP (ENG) |
| Dell Wyse 5470 AIO Thin Client with PCoIP (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 5470 AIO Thin Client with PCoIP (JPN) |
| Dell Wyse 5470 Thin Client (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol | 8.6 MR8 | Dell Wyse 5470 Thin Client (ENG) |
| Dell Wyse 5470 Thin Client (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol | 8.6 MR8 | Dell Wyse 5470 Thin Client (JPN) |
| Dell Wyse 5470 Thin Client with PCoIP (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol | 8.6 MR8 | Dell Wyse 5470 Thin Client with PCoIP (ENG) |
| Dell Wyse 5470 Thin Client with PCoIP (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 5470 Thin Client with PCoIP (JPN) |
| Dell Wyse 7010 Thin Client (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol | 8.6 MR8 | Dell Wyse 7010 Thin Client (ENG) |
| Dell Wyse 7010 thin client (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol | 8.6 MR8 | Dell Wyse 7010 thin client (JPN) |
| Product | Affected Version(s) | Updated Version(s) | Link to Update |
| Dell Wyse 3040 Thin Client (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol | 8.6 MR8 | Dell Wyse 3040 Thin Client (ENG) |
| Dell Wyse 3040 Thin Client (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 3040 Thin Client (JPN) |
| Dell Wyse 3040 Thin Client with PCoIP (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 3040 Thin Client with PCoIP (ENG) |
| Dell Wyse 3040 Thin Client with PCoIP (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 3040 Thin Client with PCoIP (JPN) |
| Dell Wyse 5010 Thin Client (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol | 8.6 MR8 | Dell Wyse 5010 Thin Client (ENG) |
| Dell Wyse 5010 Thin Client (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol | 8.6 MR8 | Dell Wyse 5010 Thin Client (JPN) |
| Dell Wyse 5010 Thin Client with PCoIP (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 5010 Thin Client with PCoIP (ENG) |
| Dell Wyse 5010 Thin Client with PCoIP (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 5010 Thin Client with PCoIP (JPN) |
| Dell Wyse 5040 Thin Client (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol | 8.6 MR8 | Dell Wyse 5040 Thin Client (ENG) |
| Dell Wyse 5040 Thin Client (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol | 8.6 MR8 | Dell Wyse 5040 Thin Client (JPN) |
| Dell Wyse 5040 Thin Client with PCoIP (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 5040 Thin Client with PCoIP (ENG) |
| Dell Wyse 5040 Thin Client with PCoIP (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 5040 Thin Client with PCoIP (JPN) |
| Dell Wyse 5060 Thin Client (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 5060 Thin Client (ENG) |
| Dell Wyse 5060 Thin Client (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol | 8.6 MR8 | Dell Wyse 5060 Thin Client (JPN) |
| Dell Wyse 5060 Thin Client with PCoIP (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 5060 Thin Client with PCoIP (ENG) |
| Dell Wyse 5060 Thin Client with PCoIP (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 5060 Thin Client with PCoIP (JPN) |
| Dell Wyse 5070 Thin Client (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol | 8.6 MR8 | Dell Wyse 5070 Thin Client (ENG) |
| Dell Wyse 5070 Thin Client (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol | 8.6 MR8 | Dell Wyse 5070 Thin Client (JPN) |
| Dell Wyse 5070 Thin Client with PCoIP (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 5070 Thin Client with PCoIP (ENG) |
| Dell Wyse 5070 Thin Client with PCoIP (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 5070 Thin Client with PCoIP (JPN) |
| Dell Wyse 5470 AIO Thin Client (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 5470 AIO Thin Client (ENG) |
| Dell Wyse 5470 AIO Thin Client (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 5470 AIO Thin Client (JPN) |
| Dell Wyse 5470 AIO Thin Client with PCoIP (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 5470 AIO Thin Client with PCoIP (ENG) |
| Dell Wyse 5470 AIO Thin Client with PCoIP (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 5470 AIO Thin Client with PCoIP (JPN) |
| Dell Wyse 5470 Thin Client (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol | 8.6 MR8 | Dell Wyse 5470 Thin Client (ENG) |
| Dell Wyse 5470 Thin Client (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol | 8.6 MR8 | Dell Wyse 5470 Thin Client (JPN) |
| Dell Wyse 5470 Thin Client with PCoIP (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol | 8.6 MR8 | Dell Wyse 5470 Thin Client with PCoIP (ENG) |
| Dell Wyse 5470 Thin Client with PCoIP (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol |
8.6 MR8 | Dell Wyse 5470 Thin Client with PCoIP (JPN) |
| Dell Wyse 7010 Thin Client (ENG) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol | 8.6 MR8 | Dell Wyse 7010 Thin Client (ENG) |
| Dell Wyse 7010 thin client (JPN) | Versions prior to 8.6 MR8 where the Client is receiving configurations from a remote file server over an insecure protocol | 8.6 MR8 | Dell Wyse 7010 thin client (JPN) |
Below are best practices to address this issue. Dell recommends customers implement one of the following:
Dell would like to thank Prof. Gil David and Elad Luz of CyberMDX for reporting this vulnerability.
| Revision | Date | Description |
| 1.0 | 2020-12-21 | Initial Release |
Dell Security Advisories and Notices
Dell Vulnerability Response Policy
CVSS Scoring Guide
Dell Technologies 보안 권장 사항에 포함된 정보를 읽고 여기에 설명된 문제로 인해 발생할 수 있는 상황을 피하는 데 도움을 받으십시오. Dell Technologies는 보안 권장 사항을 배포하여 영향을 받는 제품의 사용자에게 중요한 보안 정보를 제공합니다. Dell Technologies는 다양하게 설치된 시스템에서 평균적으로 발생하는 위험을 기반으로 위험을 평가하므로 로컬 설치 및 개별 환경에서 발생하는 실제 위험은 표시되지 않을 수 있습니다. 모든 사용자가 이 정보를 개별 환경에 적용할 수 있는지 여부를 결정하고 적절한 조치를 취하는 것이 좋습니다. 여기에 명시된 정보는 어떠한 보증도 없이 "있는 그대로" 제공됩니다. Dell Technologies는 상품성, 특정 목적에의 적합성, 소유권 및 비침해에 대한 보증을 포함한 어떠한 명시적 또는 묵시적 보증도 하지 않습니다. 어떠한 경우에도 Dell Technologies와 해당 계열사 또는 공급업체는 여기에 포함된 정보 또는 이를 기반으로 수행하도록 결정한 조치로 인해 발생할 가능성이 있는 손해(직접적, 간접적, 부수적, 결과적, 비즈니스 이익 손실 또는 특수한 손해 포함)에 대해 책임을 지지 않습니다. 일부 주에서는 결과적 또는 부수적 손해에 대한 책임의 배제 또는 제한을 허용하지 않으므로 전술한 제한은 법률에 따라 허용되는 범위까지 적용됩니다.
Wyse ThinOS
17 2월 2021
2
Dell Security Advisory