TI-2021-04617 Aliases CVE-2021-21532 GHSA-3gp6-mhp9-qvmh

Improper input validation in Dell Wyse Proprietary OS

LOW 27CWE-16Published 2021-04-02 · Updated 2024-09-16

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Dell Wyse ThinOS 8.6 MR9 contains remediation for an improper management server validation vulnerability that could be potentially exploited to redirect a client to an attacker-controlled management server, thus allowing the attacker to change the device configuration or certificate file.

Why it matters now

EPSS 0.00214 11th percentileScored 2026-11-07

Fix Fixed Wyse Proprietary OS (ThinOS) (Dell): ThinOS 8.6 MR9

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Dell	Wyse Proprietary OS (ThinOS)	before ThinOS 8.6 MR9	ThinOS 8.6 MR9	Patch available	CNA

Wyse Proprietary OS (ThinOS) VendorDell Affected before ThinOS 8.6 MR9 Fixed in ThinOS 8.6 MR9 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:dell:wyse_thinos::::::::	before 8.6	Vulnerable	Dell
cpe:2.3:o:dell:wyse_thinos:8.6:-::::::	8.6	Vulnerable	Dell

cpe:2.3:o:dell:wyse_thinos:*:*:*:*:*:*:*:* Versions before 8.6 Vulnerable ·Dell
cpe:2.3:o:dell:wyse_thinos:8.6:-:*:*:*:*:*:* Versions 8.6 Vulnerable ·Dell

Remediation

Fix · CNA Wyse Proprietary OS (ThinOS) (Dell) Fixed in ThinOS 8.6 MR9

Timeline

2026-10-02 Threatist record created from CVE-2021-21532
2026-10-03 Alias added: GHSA-3gp6-mhp9-qvmh

References

Advisory 1

https://www.dell.com/support/kbdoc/en-us/000184665/dsa-2021-069-dell-wyse-thinos-8-6-security-update-for-an-improper-management-server-validation-vulnerabilitydsa-2021-069-dell-wyse-thinos-8-6-security-update-for-an-improper-management-server-validation-

TI-2020-17713 Incorrect default permissions in Dell Wyse Proprietary OS CVSS 3.1CRITICAL 10.0
TI-2020-17712 Incorrect default permissions in Dell Wyse Proprietary OS CVSS 3.1CRITICAL 10.0
TI-2024-28404 Command injection in Dell Wyse Proprietary OS CVSS 3.1HIGH 7.6
TI-2022-15300 Regular expression denial of service in Dell Wyse Proprietary OS CVSS 3.1MEDIUM 6.8
TI-2021-04677 Sensitive information in log files in Dell Wyse ThinOS CVSS 3.1HIGH 7.2
TI-2023-15740 Cleartext storage of sensitive information in Dell Wyse Proprietary OS CVSS 3.1MEDIUM 5.5

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences