Remote Command Vulnerability in Wyse Device Manager by Wyse Technology

CVE-2009-0695

Summary

The hagent.exe component in Wyse Device Manager version 4.7.x lacks authentication requirements for executing commands. This security flaw permits remote attackers to gain unauthorized management access by sending specially crafted queries. As demonstrated by a specific V52 query, attackers can execute critical commands, such as initiating a power-off action, thereby compromising device control and operational integrity. This makes devices vulnerable to various attacks, including unauthorized shutdowns and potential data loss.

References