EUVD-2026-75563
GHSA-v8gh-hqfc-c796
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain physical access to thin client
-
DeliveryAuthenticate with low-privileged account
-
ExploitAccess firmware/UEFI SVN interface
-
ExecutionOverwrite security version number with older value
-
PersistFlash older vulnerable firmware
-
ImpactBypass protection mechanisms enforced in current firmware
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Hardware security configuration
|
| Exploitation Conditions | Exploitation requires physical access to the ThinOS 10 device (AV:P) and a low-privileged account on the device (PR:L). The attacker must be able to interact with the firmware's SVN storage - likely through a BIOS/UEFI menu, firmware update interface, or writable NVRAM accessible from the OS layer. Exploitation is limited to: physical device access, possession of low-privileged credentials, and knowledge of the SVN storage mechanism sufficient to overwrite it. Remote exploitation is not possible. High-privilege or administrative credentials are not required, but unauthenticated exploitation is also not possible - some account-level access is needed per the PR:L vector. |
| Impact | Real-world risk is moderate despite high C/I/A CVSS sub-scores. The CVSS vector AV:P/AC:L/PR:L constrains exploitation to an attacker who has both physical possession of and low-privilege authentication to the device - a significant limiting factor. The EPSS data is not provided, and the vulnerability is not listed in CISA KEV, indicating no confirmed active or widespread exploitation. No public exploit code is referenced. The scenario most relevant to defenders is insider threat or supply chain attack (e.g., a device intercepted in transit or accessed in an unlocked office/medical cart). The high C/I/A scores reflect that a successful downgrade enables subsequent exploitation of older, patched vulnerabilities on the rolled-back firmware - the impact is indirect rather than immediate. CVSS overall score of 6.6 (Medium) is reasonable given the physical access prerequisite, though 'Authentication Bypass' tag mislabels the mechanism (see data_quality_flags). |
| Exploit ScenarioDerived | An attacker - such as a disgruntled employee or visitor with momentary access to an unattended thin client - authenticates with a low-privileged account, modifies the Security Version Number register to an older value through a firmware interface or writable storage, and then flashes a prior vulnerable firmware version. No public exploit code is referenced, so exploitation currently requires specific knowledge of the ThinOS firmware internals and the SVN storage mechanism. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 10, 2026
Dell ThinOS 10 firmware allows a low-privileged attacker with physical device access to overwrite the Security Version Number (SVN) with an older value, enabling a downgrade rollback to earlier firmware versions that lack current security protections. All releases prior to 2605_10.2616 are affected. By reverting the device to a prior vulnerable firmware state, an attacker can bypass protection mechanisms enforced in newer firmware - including security controls, hardening measures, or patched vulnerabilities - achieving full confidentiality, integrity, and availability compromise of the thin client.
RemediationAI
Update Dell ThinOS 10 to build 2605_10.2616 or later, which contains the vendor-released fix per Dell advisory DSA-2026-389 at https://www.dell.com/support/kbdoc/en-us/000502746/. As a compensating control prior to patching, restrict physical access to ThinOS endpoints - use physical cable locks, secured desk deployments, or locked carts. In healthcare/kiosk environments, enforce least-privilege policies to prevent low-privileged users from accessing firmware settings or BIOS/UEFI menus. Enabling Dell's Secure Boot enforcement policies (where independently configurable) would add a layer of protection. Note that physical access controls are the most effective mitigation before the patch is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-1328 ('Security Version Number Mutable to Older Versions') describes a class of hardware/firmware vulnerability where the anti-rollback counter or security version number - designed to prevent downgrading to older, less-secure firmware - can be set to a lower value by an attacker. In secure firmware architectures, the SVN is typically stored in write-once or fuse-based storage to be monotonically increasing; if this mechanism is bypassable (e.g., via writable NVRAM, unprotected UEFI variable, or similar), an attacker can write an older SVN and then flash legacy firmware. The affected CPE is cpe:2.3:a:dell:thinos_10:*:*:*:*:*:*:*:* for all versions preceding build 2605_10.2616. Dell ThinOS is a purpose-built thin client OS deployed in enterprise endpoint environments and commonly used in healthcare, finance, and VDI scenarios.
Know when Thinos 10 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Physical access (AV:P) and low-privilege authentication (PR:L) are required; downgrade enables full system compromise, justifying C:H/I:H/A:H.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
1DescriptionCVE.org
Dell ThinOS 10, versions prior to 2605_10.2616, contain a Security Version Number Mutable to Older Versions vulnerability. A low privileged attacker with physical access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Remote code execution in Dell ThinOS 10 (versions prior to 2605_10.2616) allows an unauthenticated remote attacker to in
Arbitrary code execution in Dell ThinOS 10 (all builds prior to 2605_10.2616) allows a remote, unauthenticated attacker
Remote code execution in Dell ThinOS 10 (all versions prior to 2605_10.2616) allows an unauthenticated attacker who alre
Missing authentication for a critical device function in Dell ThinOS 10 (all versions prior to SecurityAddon_2605.10.276
Improper TLS certificate validation in Dell ThinOS 10 endpoints running SecurityAddon builds prior to 2605.10.2766_T10 l
Unauthorized access in Dell ThinOS 10 (versions prior to 2605_10.2100) stems from an obsolete UI feature (CWE-448) that
Improper access control in Dell ThinOS 10 (all versions prior to 2605_10.2518) enables a local low-privileged user to by
Local privilege escalation in Dell ThinOS 10 versions prior to ThinOS10 2602_10.0765 allows a low-privileged user with l
Authenticated remote command execution in Dell ThinOS 10 (builds prior to 2605_10.2616) allows an attacker who already h
Arbitrary code execution on Dell ThinOS 10 (all versions prior to 2605_10.2616) is possible when an unauthenticated atta
Arbitrary code execution in Dell ThinOS 10 (all builds prior to 2605_10.2616) is enabled by a missing integrity check (C
Protection mechanism failure in Dell ThinOS 10 (versions prior to 2605_10.2100) allows an unauthenticated attacker with
Exploit-DB