Incorrect permission assignment in Dell ThinOS 10
Priority LOW 35CWE-732Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Dell ThinOS 10, versions prior to 2508_10.0127, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A local low-privileged attacker could potentially exploit this vulnerability leading to Elevation of Privileges and Unauthorized Access.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0013 2nd percentileScored 2026-11-07
Fix Fixed ThinOS 10 (Dell): 2508_10.0127
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dell | ThinOS 10 | N/A to before 2508_10.0127 | 2508_10.0127 | Patch available | CNA |
- ThinOS 10 VendorDell Affected N/A to before 2508_10.0127 Fixed in 2508_10.0127 Patch available CNA
CPE configurations NVD · 33
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:dell:thinos:*:*:*:*:*:*:*:* | before 2508 | Vulnerable | Dell |
| cpe:2.3:h:dell:latitude_3330:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:latitude_3420:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:latitude_3440:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:latitude_3450:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:latitude_5440:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:latitude_5450:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:latitude_5520:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:latitude_5530:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:latitude_5540:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
- cpe:2.3:o:dell:thinos:*:*:*:*:*:*:*:* Versions before 2508 Vulnerable ·Dell
- cpe:2.3:h:dell:latitude_3330:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:latitude_3420:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:latitude_3440:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:latitude_3450:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:latitude_5440:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:latitude_5450:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:latitude_5520:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:latitude_5530:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:latitude_5540:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
Show 23 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:dell:latitude_5550:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:optiplex_3000_tc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:optiplex_5400_all-in-one:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:optiplex_7020:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:optiplex_all-in-one_7410:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:optiplex_all-in-one_7420:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:optiplex_micro_plus_7010:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:precision_3260_compact:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:precision_3280:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_14_pc14250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_16_pc16250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_16_plus_pb16250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_24_all-in-one:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_max_14:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_max_16_plus:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_rugged_13_ra13250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_rugged_14_rb14250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_slim_low_sff:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_tower_qct1250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:wyse_5070_extended_thin_client:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:wyse_5070_thin_client:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:wyse_5470_all-in-one_thin_client:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:wyse_5470_mtc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
- cpe:2.3:h:dell:latitude_5550:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:optiplex_3000_tc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:optiplex_5400_all-in-one:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:optiplex_7020:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:optiplex_all-in-one_7410:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:optiplex_all-in-one_7420:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:optiplex_micro_plus_7010:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:precision_3260_compact:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:precision_3280:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_14_pc14250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_16_pc16250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_16_plus_pb16250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_24_all-in-one:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_max_14:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_max_16_plus:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_rugged_13_ra13250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_rugged_14_rb14250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_slim_low_sff:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_tower_qct1250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:wyse_5070_extended_thin_client:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:wyse_5070_thin_client:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:wyse_5470_all-in-one_thin_client:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:wyse_5470_mtc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
Remediation
- Fix · CNA ThinOS 10 (Dell) Fixed in 2508_10.0127
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Dell ThinOS 10 — dell.com/support/kbdoc/en-us/000359619/dsa-2025-331
4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2025-28316 Protection mechanism failure in Dell ThinOS 10Priority MEDIUM 43
- TI-2025-28318 Dell ThinOS 10, versions prior to 2508_10.0127, contains an Improper Neutralization of…Priority LOW 38
- TI-2025-28459 Dell ThinOS 10, versions prior to 2508_10.0127, contains an Unverified Ownership…Priority LOW 35
Timeline
- 2026-10-02 Threatist record created from CVE-2025-43729
- 2026-10-03 Alias added: GHSA-877q-4j62-9hxq
References
More Dell Thinos vulnerabilities
- TI-2026-56219 OS command injection in Dell ThinOS 10 CVSS 3.1CRITICAL 9.8
- TI-2026-56047 Improper access control in Dell ThinOS 10 CVSS 3.1CRITICAL 9.4
- TI-2026-56048 Command injection in Dell ThinOS 10 CVSS 3.1CRITICAL 9.6
- TI-2026-56220 OS command injection in Dell ThinOS 10 CVSS 3.1CRITICAL 9.1
- TI-2025-28316 Protection mechanism failure in Dell ThinOS 10 CVSS 3.1CRITICAL 9.8
- TI-2024-35752 Command injection in Dell Wyse Proprietary OS CVSS 3.1HIGH 8.4
Sources
- CVE-2025-43729 · CVE Program
- CVE-2025-43729 · NVD
- FIRST EPSS
- GHSA-877q-4j62-9hxq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences