DSA-2025-135: Security Update for Dell Wyse Management Suite (WMS) for Multiple Vulnerabilities
Summary: Dell Wyse Management Suite (WMS) remediation is available for multiple vulnerabilities that could be exploited by malicious users to compromise the affected system.
Impact
High
Details
|
Third-party Component |
CVEs |
More Information |
|
MongoDB |
CVE-2022-4904, CVE-2022-24407, CVE-2023-48795, CVE-2021-32050, CVE-2022-44792 |
|
Proprietary Code CVEs |
Description |
CVSS Base Score |
CVSS Vector String |
|
CVE-2025-29981 |
Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Exposure of Sensitive Information Through Data Queries vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information Disclosure. |
7.5 |
|
|
CVE-2025-29982 |
Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Insecure Inherited Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access. |
6.8
|
|
|
CVE-2025-27694 |
Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Insufficient Resource Pool vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service. |
5.3 |
|
|
CVE-2025-27693 |
Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection. |
4.9 |
|
|
CVE-2025-27692 |
Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service, Information Disclosure, and Remote execution |
4.7 |
|
|
CVE-2025-27695 |
Dell Wyse Management Suite, versions prior to WMS 5.1 contain an Authentication Bypass by Spoofing vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information Disclosure. |
4.9 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
|
|
Proprietary Code CVEs |
Description |
CVSS Base Score |
CVSS Vector String |
|
CVE-2025-29981 |
Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Exposure of Sensitive Information Through Data Queries vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information Disclosure. |
7.5 |
|
|
CVE-2025-29982 |
Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Insecure Inherited Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access. |
6.8
|
|
|
CVE-2025-27694 |
Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Insufficient Resource Pool vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service. |
5.3 |
|
|
CVE-2025-27693 |
Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection. |
4.9 |
|
|
CVE-2025-27692 |
Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service, Information Disclosure, and Remote execution |
4.7 |
|
|
CVE-2025-27695 |
Dell Wyse Management Suite, versions prior to WMS 5.1 contain an Authentication Bypass by Spoofing vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information Disclosure. |
4.9 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
|
Produse afectate și măsuri de remediere
|
CVEs addressed |
Product |
Affected Versions |
Remediated Versions |
Release Date |
Link |
|
CVE-2025-29981, CVE-2025-29982, CVE-2025-27694, CVE-2025-27693, CVE-2022-4904, CVE-2022-24407, CVE-2023-48795, CVE-2021-32050, CVE-2022-44792, CVE-2025-27695 |
Dell Wyse Management Suite |
Versions prior to 5.1 |
Version 5.1 or later |
03/31/2025 |
|
|
CVE-2025-27692 |
Dell Wyse Management Suite Repository |
Versions prior to 5.1
|
Version 5.1 or later |
03/31/2025 |
|
CVEs addressed |
Product |
Affected Versions |
Remediated Versions |
Release Date |
Link |
|
CVE-2025-29981, CVE-2025-29982, CVE-2025-27694, CVE-2025-27693, CVE-2022-4904, CVE-2022-24407, CVE-2023-48795, CVE-2021-32050, CVE-2022-44792, CVE-2025-27695 |
Dell Wyse Management Suite |
Versions prior to 5.1 |
Version 5.1 or later |
03/31/2025 |
|
|
CVE-2025-27692 |
Dell Wyse Management Suite Repository |
Versions prior to 5.1
|
Version 5.1 or later |
03/31/2025 |
CVE-2025-27695 can be chained with other vulnerabilities in this advisory which results in a chained CVSS score of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Revision History
|
Revision |
Date |
Description |
|
1.0 |
2025-04-01 |
Initial Release |
|
2.0 |
2025-05-08 |
Updated CVE details and Proprietary Code table and Acknowledgments to add CVE-2025-27695 |
|
3.0 |
2025-05-08 |
Corrected CVSS Vector String link to CVE-2025-27695 |
|
4.0 |
2025-05-08 |
Corrected CVSS Vector String link |
|
5.0 |
2025-05-15 |
Updated Acknowledgement section |
Acknowledgements
CVE-2025-29982: Dell Technologies would like to thank Pwni and falconCorrup for reporting this issue.
CVE-2025-27694, CVE-2025-27693, CVE-2025-27692, CVE-2025-27695: Dell Technologies would like to thank Alain Mowat from Orange Cyberdefense Switzerland's research lab for reporting these issues.
CVE-2025-29981: Dell Technologies would like to thank coolz0r for reporting this issue.
CVE-2025-27695: Dell Technologies would like to thank Roberto Suggi Liverani NCIA/NCSC Researcher for reporting this issue to us