Description
hagent.exe in Wyse Device Manager (WDM) 4.7.x does not require authentication for commands, which allows remote attackers to obtain management access via a crafted query, as demonstrated by a V52 query that triggers a power-off action.
Exploits (3)
metasploit
WORKING POC
EXCELLENT
rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/wyse/hagent_untrusted_hsdata.rb
References (5)
Core 5
Core References
Various Sources x_refsource_misc
http://www.wyse.com/serviceandsupport/Wyse%20Security%20Bulletin%20WSB09-01.pdf
US Government Resource third-party-advisory
x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/654545
Third Party Advisory mailing-list
x_refsource_fulldisc
http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0101.html
Various Sources x_refsource_misc
http://www.theregister.co.uk/2009/07/10/wyse_remote_exploit_bugs/
Exploit exploit
x_refsource_exploit-db
http://www.exploit-db.com/exploits/19137/
Scores
EPSS
0.6423
EPSS Percentile
98.5%
Details
CWE
CWE-287
Status
published
Products (3)
dell/wyse_device_manager
4.7.0
dell/wyse_device_manager
4.7.1
dell/wyse_device_manager
4.7.2
Published
Jun 19, 2012
Tracked Since
Feb 18, 2026