Critical bugs in Dell Wyse ThinOS allow thin client take over

guest · Dec 21, 2020

Critical bugs in Dell Wyse ThinOS allow thin client take over
December 21, 2020
https://www.bleepingcomputer.com/ne...dell-wyse-thinos-allow-thin-client-take-over/

Almost a dozen Dell Wyse thin client models are vulnerable to critical issues that could be exploited by a remote attacker to run malicious code and gain access to arbitrary files.

It is estimated that more than 6,000 organizations, most of them from the healthcare sector, have deployed Dell Wyse thin clients on their networks.
Configuration file at risk
The vulnerabilities (tracked as CVE-2020-29492 and CVE-2020-29491) are in components of ThinOS, the operating system on Dell Wyse thin clients.
Click to expand...

They also discovered that only the firmware and packages are signed, leaving INI configuration files as a possible way for a malicious actor to do some damage.

One scenario an attacker could leverage these vulnerabilities is to read or modify parameters in the configuration file that would give them remote control over the thin device. Leaking credentials or manipulating DNS results are also on the list of risks that could stem from exploiting the two bugs.
Click to expand...

In its security advisory, Dell recommends securing the environment by using a secure protocol (HTTPS) and ensuring that the file servers have read-only access.
Click to expand...

CyberMDX: CyberMDX Research Team Discovers Vulnerability in Dell Wyse Thin Clients

The profound potential impact of these vulnerabilities coupled with the relative ease of exploitation is what makes them so critical. This criticality is captured in the severity scores of both vulnerabilities - 10 / 10.
Affected are all Dell Wyse Thin Clients running ThinOS versions 8.6 and below: [...]
Click to expand...

Log in or Sign up

Critical bugs in Dell Wyse ThinOS allow thin client take over

guest Guest

Log in or Sign up

Critical bugs in Dell Wyse ThinOS allow thin client take over

guest Guest

Useful Searches