← back
CVE-2009-0695

CVE-2009-0695

EPSS 69.6%
hagent.exe in Wyse Device Manager (WDM) 4.7.x does not require authentication for commands, which allows remote attackers to obtain management access via a crafted query, as demonstrated by a V52 query that triggers a power-off action.
Affected products
n/a · n/a
public PoCs found — 3
cve_referencewww.exploit-db.com/exploits/19137/unverifiedexploitdbwww.exploit-db.com/exploits/19137unverifiedexploitdbwww.exploit-db.com/exploits/9934unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0101.htmlhttp://www.exploit-db.com/exploits/19137/http://www.kb.cert.org/vuls/id/654545http://www.theregister.co.uk/2009/07/10/wyse_remote_exploit_bugs/http://www.wyse.com/serviceandsupport/Wyse%20Security%20Bulletin%20WSB09-01.pdf