CVE-2009-0695: Wyse Device Manager hagent.exe missing authentication allows remote management access

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated remote management access with partial C/I/A impact and a high EPSS score, though no KEV listing or confirmed in-the-wild exploitation is recorded.

What it is

hagent.exe in Wyse Device Manager (WDM) 4.7.x does not require authentication for commands, so a remote attacker can send a crafted query to obtain management access. A demonstrated V52 query can trigger a power-off action, showing the flaw reaches device control, not just information disclosure.

Impact

An unauthenticated attacker gains management access to the WDM service and can issue commands such as powering off managed devices. The CVSS 2.0 vector rates partial confidentiality, integrity and availability impact.

Attack surface

Reachable over the network via the hagent.exe service; the AV:N/AC:L/Au:N vector and the description both indicate no authentication is needed. No user interaction is described.

Exploitation

An Exploit-DB entry is tagged as an exploit reference, and EPSS is 0.68887 (99.3rd percentile), indicating high predicted exploitation activity. The CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is recorded here.

What to do

• Apply the vendor fix referenced in Wyse Security Bulletin WSB09-01; if no supported patch exists for the installed 4.7.x build, upgrade to a supported WDM release.
• Restrict network access to the hagent.exe service (and WDM management ports) to trusted management hosts only, using firewall rules or network segmentation.
• Do not expose WDM management interfaces to untrusted networks or the internet.
• Monitor and log commands accepted by hagent.exe, and alert on unexpected power-off or management actions.
• If the service cannot be patched or isolated, disable it where it is not required.

Detection

• Monitor network traffic to the hagent.exe service port for unauthenticated or malformed query patterns, including V52-style queries.
• Alert on unexpected device power-off or management commands originating from hosts outside the authorized management subnet.
• Review hagent.exe and WDM service logs for command execution without a preceding authentication event.
• Baseline normal management traffic and flag new or unusual source IPs sending commands to WDM.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.