Description

Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-14T16:16:58.913Z",
  "pubdate": "2026-08-14T16:16:58.913Z",
  "executiveSummary": "Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 contain an Unrestricted Upload of File with Dangerous Type vulnerability. This critical security flaw allows a high-privileged attacker with remote access to achieve Remote Code Execution (RCE) on the underlying host system. The vulnerability presents significant risk implications, potentially enabling total compromise of the affected server infrastructure, arbitrary code execution, and subsequent unauthorized access to sensitive management data. Successful exploitation requires administrative or high-privileged remote access to the management interface, combined with the ability to upload specially crafted malicious files that bypass insufficient input validation mechanisms within the application file upload component. Organizations utilizing vulnerable versions of Dell Wyse Management Suite face severe operational and security risks if malicious actors leverage administrative credentials or compromise high-privileged accounts to upload and execute malicious payloads.",
  "technicalDetails": "The vulnerability resides in the file upload processing mechanisms of Dell Wyse Management Suite (WMS) versions prior to 2605.0.2, categorized under CWE-434: Unrestricted Upload of File with Dangerous Type. The root cause of the vulnerability stems from inadequate sanitization, type validation, and extension filtering during file upload operations handled by the web application component. Attackers possessing high privileges and remote network access can interact with the vulnerable file upload interface to submit malicious files containing executable code or scripts disguised as legitimate application files or documents. Because the server-side logic fails to properly restrict dangerous file extensions or verify file content integrity against expected formats, the uploaded file is stored within an accessible directory on the web server. Once the malicious payload is successfully uploaded, the attacker can trigger its execution via direct HTTP requests or through secondary application interactions, depending on the web server configuration and environment context. This attack flow bypasses standard security controls, enabling the execution of arbitrary commands or code within the context of the running application process. The post-exploitation impact includes complete system compromise, unauthorized data exfiltration, lateral movement within the network, and persistent unauthorized access. Exploitation mandates remote network connectivity to the application interface and valid high-privileged credentials capable of accessing the specific upload functionality, limiting immediate risk to scenarios involving credential compromise or malicious insiders."
}