Product:
Wyse Management Suite
Summary
Dell Wyse Management Suite, versions prior to WMS 5.5, contain an Improper Neutralization of Input During Web Page Generation vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script Injection. This could allow unauthorized scripts to be executed in the context of a user’s session.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.4 | CVE-2026-23858 |
Exploitation
To exploit this vulnerability, an attacker must have low privileges and remote access to the affected system. By crafting a malicious input that is not properly sanitized, the attacker can inject scripts into web pages generated by the Wyse Management Suite. When a user interacts with the compromised page, the injected script can execute, potentially leading to unauthorized actions or data exposure.
Affected Products
- Wyse Management Suite versions prior to 5.5: Vulnerable to cross-site scripting attacks due to improper input neutralization.
Mitigation
To mitigate this vulnerability, users should upgrade to Wyse Management Suite version 5.5 or later. Additionally, implementing proper input validation and sanitization practices can help prevent similar vulnerabilities in the future.