Incorrect default permissions in Dell Wyse Proprietary OS
Priority MEDIUM 46CWE-276Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Dell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to access the writable file and manipulate the configuration of any target specific station.
Why it matters now
EPSS 0.01709 77th percentileScored 2026-11-07
Fix Fixed Wyse Proprietary OS (ThinOS) (Dell): 8.6
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dell | Wyse Proprietary OS (ThinOS) | before 8.6 | 8.6 | Patch available | CNA |
- Wyse Proprietary OS (ThinOS) VendorDell Affected before 8.6 Fixed in 8.6 Patch available CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:dell:wyse_thinos:*:*:*:*:*:*:*:* | up to 8.6 | Vulnerable | Dell |
| cpe:2.3:h:dell:wyse_3040:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:wyse_5010:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:wyse_5040:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:wyse_5060:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:wyse_5070:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:wyse_5470:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:wyse_7010:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
- cpe:2.3:o:dell:wyse_thinos:*:*:*:*:*:*:*:* Versions up to 8.6 Vulnerable ·Dell
- cpe:2.3:h:dell:wyse_3040:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:wyse_5010:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:wyse_5040:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:wyse_5060:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:wyse_5070:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:wyse_5470:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:wyse_7010:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
Remediation
- Fix · CNA Wyse Proprietary OS (ThinOS) (Dell) Fixed in 8.6
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Dell Wyse Proprietary OS (ThinOS) 8.6
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2020-17712 Incorrect default permissions in Dell Wyse Proprietary OSPriority MEDIUM 46
Timeline
- 2026-10-02 Threatist record created from CVE-2020-29492
- 2026-10-03 Alias added: GHSA-pwh6-hxc9-8cf2
References
More Dell Wyse Thinos vulnerabilities
- TI-2020-17712 Incorrect default permissions in Dell Wyse Proprietary OS CVSS 3.1CRITICAL 10.0
- TI-2024-28404 Command injection in Dell Wyse Proprietary OS CVSS 3.1HIGH 7.6
- TI-2022-15300 Regular expression denial of service in Dell Wyse Proprietary OS CVSS 3.1MEDIUM 6.8
- TI-2021-04677 Sensitive information in log files in Dell Wyse ThinOS CVSS 3.1HIGH 7.2
- TI-2021-04617 Improper input validation in Dell Wyse Proprietary OS CVSS 3.1MEDIUM 6.3
- TI-2023-15740 Cleartext storage of sensitive information in Dell Wyse Proprietary OS CVSS 3.1MEDIUM 5.5
Sources
- CVE-2020-29492 · CVE Program
- CVE-2020-29492 · NVD
- FIRST EPSS
- GHSA-pwh6-hxc9-8cf2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences