OS command injection in Dell ThinOS 10
Priority MEDIUM 54CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02987 87th percentileScored 2026-11-08
Fix Fixed ThinOS 10 (Dell): 2605_10.2616
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dell | ThinOS 10 | before 2605_10.2616 | 2605_10.2616 | Patch available | CNA |
- ThinOS 10 VendorDell Affected before 2605_10.2616 Fixed in 2605_10.2616 Patch available CNA
CPE configurations NVD · 40
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:dell:thinos:*:*:*:*:*:*:*:* | before 2605_10.2616 | Vulnerable | Dell |
| cpe:2.3:h:dell:latitude_3330:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:latitude_3420:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:latitude_3440:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:latitude_3450:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:latitude_5440:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:latitude_5450:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:latitude_5520:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:latitude_5530:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:latitude_5540:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
- cpe:2.3:o:dell:thinos:*:*:*:*:*:*:*:* Versions before 2605_10.2616 Vulnerable ·Dell
- cpe:2.3:h:dell:latitude_3330:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:latitude_3420:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:latitude_3440:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:latitude_3450:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:latitude_5440:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:latitude_5450:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:latitude_5520:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:latitude_5530:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:latitude_5540:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
Show 30 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:dell:latitude_5550:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:optiplex_3000_tc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:optiplex_5400_all-in-one:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:optiplex_7020:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:optiplex_all-in-one_7410:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:optiplex_all-in-one_7420:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:optiplex_micro_plus_7010:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:precision_3260_compact:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:precision_3280:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_14_pc14250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_16_pc16250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_16_plus_pb16250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_24_all-in-one:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_24_all-in-one_\(65w\)_qc24250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_24_all-in-one_plus_qb24250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_max_14:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_max_16_plus:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_max_microfcm2250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_micro-thin_client_q9m1260:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_micro_qcm1250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_rugged_13_ra13250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_rugged_14_rb14250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_slim_low_sff:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_slim_plus_xe5_oem_qbs1250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_tower_plus_xe5_oem_qbt1250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:pro_tower_qct1250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:wyse_5070_extended_thin_client:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:wyse_5070_thin_client:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:wyse_5470_all-in-one_thin_client:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:wyse_5470_mtc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
- cpe:2.3:h:dell:latitude_5550:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:optiplex_3000_tc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:optiplex_5400_all-in-one:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:optiplex_7020:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:optiplex_all-in-one_7410:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:optiplex_all-in-one_7420:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:optiplex_micro_plus_7010:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:precision_3260_compact:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:precision_3280:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_14_pc14250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_16_pc16250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_16_plus_pb16250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_24_all-in-one:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_24_all-in-one_\(65w\)_qc24250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_24_all-in-one_plus_qb24250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_max_14:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_max_16_plus:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_max_microfcm2250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_micro-thin_client_q9m1260:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_micro_qcm1250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_rugged_13_ra13250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_rugged_14_rb14250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_slim_low_sff:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_slim_plus_xe5_oem_qbs1250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_tower_plus_xe5_oem_qbt1250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:pro_tower_qct1250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:wyse_5070_extended_thin_client:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:wyse_5070_thin_client:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:wyse_5470_all-in-one_thin_client:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:wyse_5470_mtc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
Remediation
- Fix · CNA ThinOS 10 (Dell) Fixed in 2605_10.2616
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Dell ThinOS 10 — dell.com/support/kbdoc/en-us/000502746/dsa-2026-389-securit…
7 records Highest priority Priority MEDIUM 4 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2026-56047 Improper access control in Dell ThinOS 10Priority MEDIUM 49
- TI-2026-56048 Command injection in Dell ThinOS 10Priority MEDIUM 47
- TI-2026-56220 OS command injection in Dell ThinOS 10Priority MEDIUM 45
Timeline
- 2026-10-02 Threatist record created from CVE-2026-81467
- 2026-10-03 Alias added: GHSA-6mp7-g3jw-642m
References
More Dell Thinos vulnerabilities
- TI-2026-56047 Improper access control in Dell ThinOS 10 CVSS 3.1CRITICAL 9.4
- TI-2026-56048 Command injection in Dell ThinOS 10 CVSS 3.1CRITICAL 9.6
- TI-2026-56220 OS command injection in Dell ThinOS 10 CVSS 3.1CRITICAL 9.1
- TI-2025-28316 Protection mechanism failure in Dell ThinOS 10 CVSS 3.1CRITICAL 9.8
- TI-2024-35752 Command injection in Dell Wyse Proprietary OS CVSS 3.1HIGH 8.4
- TI-2025-28318 Dell ThinOS 10, versions prior to 2508_10.0127, contains an Improper Neutralization of… CVSS 3.1HIGH 8.4
Sources
- CVE-2026-81467 · CVE Program
- CVE-2026-81467 · NVD
- FIRST EPSS
- GHSA-6mp7-g3jw-642m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences