Vulnerability · Published Mar 7, 2025 · Assigned by dell
CVE-2025-26331
High 7.8
In plain English
A high-severity command injection in Wyse Proprietary OS (Modern ThinOS) from Dell. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.6%top 50.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Dell ThinOS 2411 and prior, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Dell | Wyse Proprietary OS (Modern ThinOS) | N/A – before ThinOS 2502 |
Weakness: CWE-77 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://www.dell.com/support/kbdoc/en-us/000289886/dsa-2025-107 vendor-advisory
- https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2025-26331 third-party-advisory