EUVD-2026-44741
GHSA-hvgj-r9vm-qfjw
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Physical access is the only vector (AV:P); no credentials required (PR:N); high confidentiality and integrity impact from encrypted data exposure and potential modification; no availability impact.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell ThinOS 10, versions prior to 2605_10.2100 contain a Protection Mechanism Failure vulnerability. An attacker with physical access could potentially exploit this vulnerability, leading to unauthorized access to encrypted data.
AnalysisAI
Protection mechanism failure in Dell ThinOS 10 (versions prior to 2605_10.2100) allows an unauthenticated attacker with physical device access to bypass encryption controls and gain unauthorized read and write access to data stored on the thin client. The flaw, classified as CWE-693, indicates the encryption or authentication protection subsystem can be circumvented without any credentials, consistent with the Authentication Bypass tag and CVSS PR:N rating. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the physical access constraint limits but does not eliminate risk in environments with unattended or theft-prone thin clients.
Technical ContextAI
Dell ThinOS 10 is a purpose-built, hardened operating system for thin client endpoints used in enterprise VDI and virtual desktop environments. The affected CPE (cpe:2.3:a:dell:thinos_10:*:*:*:*:*:*:*:*) encompasses all ThinOS 10 builds prior to 2605_10.2100. CWE-693 (Protection Mechanism Failure) describes a class of flaws where a security control - such as full-disk encryption, secure boot verification, or data-at-rest protection - is absent, incorrectly implemented, or can be bypassed. In this context, the vulnerability likely resides in the encryption key management, secure boot chain, or access control layer that is supposed to prevent unauthorized decryption of device-resident data. The Authentication Bypass tag further supports that the mechanism intended to require credentials before granting access to protected data can be circumvented entirely. The Physical attack vector (AV:P) in the CVSS vector confirms exploitation requires hands-on device interaction.
RemediationAI
Upgrade Dell ThinOS 10 to version 2605_10.2100 or later as documented in Dell Security Advisory DSA-2026-300 (https://www.dell.com/support/kbdoc/en-us/000489640/dsa-2026-300-security-update-for-dell-thinos-10-for-multiple-vulnerabilities). Until the patch is applied, organizations should enforce strict physical security controls: deploy cable locks or chassis locks on thin client devices, restrict physical access to deployment areas through badge-controlled entry, and establish a device inventory and chain-of-custody process to detect unauthorized removal. For thin clients in high-risk or public-facing environments, enabling BIOS/UEFI passwords and disabling boot from external media reduces the attack surface, though these do not remediate the underlying encryption bypass. Device tracking via endpoint management platforms (e.g., Wyse Management Suite) can provide alerting on offline or missing devices. These physical controls reduce exploitation opportunity but do not address the root protection mechanism failure.
Improper access control in Dell ThinOS 10 (all versions prior to 2605_10.2518) enables a local low-privileged user to by
Local privilege escalation in Dell ThinOS 10 versions prior to ThinOS10 2602_10.0765 allows a low-privileged user with l
Unauthorized access in Dell ThinOS 10 (versions prior to 2605_10.2100) stems from an obsolete UI feature (CWE-448) that
Physical access to Dell ThinOS 10 endpoints running versions prior to ThinOS10 2602_10.0765 allows an unauthenticated at
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today