CVE-2025-26331

Published: Mar 7, 2025Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: security_alert@emc.com (Secondary)

Description

Dell ThinOS 2411 and prior, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution.

Affected (1)

Products: Dell: Thinos

Dell

1 product

Thinos

Configuration A

1 vulnerable · 11 platform

Vulnerable Software	Affected Versions
Dell Thinos	Up to 2411

Running on/with	Platform Versions
Dell Latitude 3420	All versions
Dell Latitude 3440	All versions
Dell Latitude 5440	All versions
Dell Latitude 5450	All versions
Dell Optiplex 3000 Thin Client	All versions
Dell Optiplex 5400 All In One	All versions
Dell Optiplex 7410 All In One	All versions
Dell Optiplex 7420 All In One	All versions
Dell Wyse 5070 Thin Client	All versions
Dell Wyse 5470 All In One Thin Client	All versions
Dell Wyse 5470 Mobile Thin Client	All versions

Related CWEs

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (2)

https://www.dell.com/support/kbdoc/en-us/000289886/dsa-2025-107

Source: security_alert@emc.com

Vendor Advisory

https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2025-26331

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Third Party Advisory

Timeline

No history available yet.