Dell ThinOS 10, versions prior to 2605_10.2616, contain a Download of Code Without…
Priority LOW 31CWE-494Published · Updated
Key facts
- Attack vector
- Physical
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-494.
Summary
Dell ThinOS 10, versions prior to 2605_10.2616, contain a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to arbitrary code execution.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00181 7th percentileScored 2026-11-07
Fix Fixed ThinOS 10 (Dell): 2605_10.2616
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dell | ThinOS 10 | before 2605_10.2616 | 2605_10.2616 | Patch available | CNA |
- ThinOS 10 VendorDell Affected before 2605_10.2616 Fixed in 2605_10.2616 Patch available CNA
CPE configurations NVD · 40
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:dell:thinos:*:*:*:*:*:*:*:* | before 2605_10.2616 | Vulnerable | Dell |
| cpe:2.3:h:dell:latitude_3330:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:latitude_3420:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:latitude_3440:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:latitude_3450:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:latitude_5440:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:latitude_5450:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:latitude_5520:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:latitude_5530:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:latitude_5540:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
- cpe:2.3:o:dell:thinos:*:*:*:*:*:*:*:* Versions before 2605_10.2616 Vulnerable ·Dell
- cpe:2.3:h:dell:latitude_3330:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:latitude_3420:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:latitude_3440:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:latitude_3450:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:latitude_5440:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:latitude_5450:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:latitude_5520:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:latitude_5530:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:latitude_5540:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
Show 30 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:dell:latitude_5550:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:optiplex_3000_tc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:optiplex_5400_all-in-one:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:optiplex_7020:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:optiplex_all-in-one_7410:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:optiplex_all-in-one_7420:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:optiplex_micro_plus_7010:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:precision_3260_compact:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:precision_3280:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_14_pc14250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_16_pc16250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_16_plus_pb16250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_24_all-in-one:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_24_all-in-one_\(65w\)_qc24250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_24_all-in-one_plus_qb24250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_max_14:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_max_16_plus:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_max_microfcm2250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_micro-thin_client_q9m1260:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_micro_qcm1250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_rugged_13_ra13250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_rugged_14_rb14250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_slim_low_sff:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_slim_plus_xe5_oem_qbs1250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_tower_plus_xe5_oem_qbt1250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_tower_qct1250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:wyse_5070_extended_thin_client:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:wyse_5070_thin_client:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:wyse_5470_all-in-one_thin_client:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:wyse_5470_mtc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
- cpe:2.3:h:dell:latitude_5550:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:optiplex_3000_tc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:optiplex_5400_all-in-one:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:optiplex_7020:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:optiplex_all-in-one_7410:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:optiplex_all-in-one_7420:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:optiplex_micro_plus_7010:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:precision_3260_compact:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:precision_3280:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_14_pc14250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_16_pc16250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_16_plus_pb16250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_24_all-in-one:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_24_all-in-one_\(65w\)_qc24250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_24_all-in-one_plus_qb24250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_max_14:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_max_16_plus:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_max_microfcm2250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_micro-thin_client_q9m1260:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_micro_qcm1250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_rugged_13_ra13250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_rugged_14_rb14250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_slim_low_sff:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_slim_plus_xe5_oem_qbs1250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_tower_plus_xe5_oem_qbt1250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_tower_qct1250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:wyse_5070_extended_thin_client:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:wyse_5070_thin_client:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:wyse_5470_all-in-one_thin_client:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:wyse_5470_mtc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
Remediation
- Fix · CNA ThinOS 10 (Dell) Fixed in 2605_10.2616
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Dell ThinOS 10 — dell.com/support/kbdoc/en-us/000502746/dsa-2026-389-securit…
7 records Highest priority Priority MEDIUM 4 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2026-56219 OS command injection in Dell ThinOS 10Priority MEDIUM 54
- TI-2026-56047 Improper access control in Dell ThinOS 10Priority MEDIUM 49
- TI-2026-56048 Command injection in Dell ThinOS 10Priority MEDIUM 47
Timeline
- 2026-10-02 Threatist record created from CVE-2026-81052
- 2026-10-03 Alias added: GHSA-4g5j-f8c3-p2cx
References
More Dell Thinos vulnerabilities
- TI-2026-56219 OS command injection in Dell ThinOS 10 CVSS 3.1CRITICAL 9.8
- TI-2026-56047 Improper access control in Dell ThinOS 10 CVSS 3.1CRITICAL 9.4
- TI-2026-56048 Command injection in Dell ThinOS 10 CVSS 3.1CRITICAL 9.6
- TI-2026-56220 OS command injection in Dell ThinOS 10 CVSS 3.1CRITICAL 9.1
- TI-2025-28316 Protection mechanism failure in Dell ThinOS 10 CVSS 3.1CRITICAL 9.8
- TI-2024-35752 Command injection in Dell Wyse Proprietary OS CVSS 3.1HIGH 8.4
Sources
- CVE-2026-81052 · CVE Program
- CVE-2026-81052 · NVD
- FIRST EPSS
- GHSA-4g5j-f8c3-p2cx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences