Sensitive information in log files in Dell Wyse ThinOS
Priority LOW 18CWE-532Published · Updated
Key facts
- Attack vector
- Physical
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-532.
Summary
Dell Wyse ThinOS, versions 9.0, 9.1, and 9.1 MR1, contain a Sensitive Information Disclosure Vulnerability. An authenticated attacker with physical access to the system could exploit this vulnerability to read sensitive Smartcard data in log files.
Why it matters now
EPSS 0.0025 16th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dell | Wyse ThinOS | 9.0, 9.1, 9.1 MR1 | — | No fix listed | CNA |
- Wyse ThinOS VendorDell Affected 9.0, 9.1, 9.1 MR1 Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:dell:wyse_thinos:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Dell |
| cpe:2.3:o:dell:wyse_thinos:9.1:*:*:*:*:*:*:* | 9.1 | Vulnerable | Dell |
| cpe:2.3:o:dell:wyse_thinos:9.1:mr1:*:*:*:*:*:* | 9.1 mr1 | Vulnerable | Dell |
| cpe:2.3:h:dell:wyse_3040_thin_client:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:wyse_5070_thin_client:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:wyse_5470_thin_client:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
- cpe:2.3:o:dell:wyse_thinos:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Dell
- cpe:2.3:o:dell:wyse_thinos:9.1:*:*:*:*:*:*:* Versions 9.1 Vulnerable ·Dell
- cpe:2.3:o:dell:wyse_thinos:9.1:mr1:*:*:*:*:*:* Versions 9.1 mr1 Vulnerable ·Dell
- cpe:2.3:h:dell:wyse_3040_thin_client:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:wyse_5070_thin_client:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:wyse_5470_thin_client:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-21598
- 2026-10-03 Alias added: GHSA-c49h-jv3f-mrwc
References
More Dell Wyse Thinos vulnerabilities
- TI-2020-17713 Incorrect default permissions in Dell Wyse Proprietary OS CVSS 3.1CRITICAL 10.0
- TI-2020-17712 Incorrect default permissions in Dell Wyse Proprietary OS CVSS 3.1CRITICAL 10.0
- TI-2024-28404 Command injection in Dell Wyse Proprietary OS CVSS 3.1HIGH 7.6
- TI-2022-15300 Regular expression denial of service in Dell Wyse Proprietary OS CVSS 3.1MEDIUM 6.8
- TI-2021-04677 Sensitive information in log files in Dell Wyse ThinOS CVSS 3.1HIGH 7.2
- TI-2021-04617 Improper input validation in Dell Wyse Proprietary OS CVSS 3.1MEDIUM 6.3
Sources
- CVE-2021-21598 · CVE Program
- CVE-2021-21598 · NVD
- FIRST EPSS
- GHSA-c49h-jv3f-mrwc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences