CVE-2019-3712 json
DSA-2019-039: Dell Wyse Device Agent Buffer Overflow Vulnerability
published 2019-03-07 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-13347
- cvss
- 8.2
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 60%
- public exploits
- 0
- none known
Summary
Dell WES Wyse Device Agent versions prior to 14.1.2.9 and Dell Wyse ThinLinux HAgent versions prior to 5.4.55 00.10 contain a buffer overflow vulnerability. An unauthenticated attacker may potentially exploit this vulnerability to execute arbitrary code on the system with privileges of the FTP client by sending specially crafted input data to the affected system. The FTP code that contained the vulnerability has been removed.
Patch / fix
- dell windows_embedded_standard_wyse_device_agent 14.1.2.9
- dell wyse_thinlinux_hagent 5.4.55_00.10
Exploit prediction
0.90% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 8.2 | CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L |
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 8.3 | AV:A/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- Dell Wyse Device Agent
- Dell Wyse ThinLinux HAgent
Classification
- Weakness
-
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
-
dell.com
/support/article/us/en/19/sln316391
patch, vendor-advisory
-
securityfocus.com
/bid/107376
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2019-3712
- NVD CVE-2019-3712
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.