EUVD-2026-75560
GHSA-4g5j-f8c3-p2cx
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Physical access required (AV:P); no credentials needed at device level (PR:N); full impact once attacker controls code delivery channel.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell ThinOS 10, versions prior to 2605_10.2616, contain a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to arbitrary code execution.
AnalysisAI
Arbitrary code execution on Dell ThinOS 10 (all versions prior to 2605_10.2616) is possible when an unauthenticated attacker gains physical access to a thin client endpoint and exploits the absence of cryptographic integrity verification during code download (CWE-494). The vulnerability allows substitution of a malicious payload during the device's update or provisioning process, resulting in full system compromise with high confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires direct, hands-on physical access to a Dell ThinOS 10 endpoint running a version prior to 2605_10.2616. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.8 score correctly reflects the physical access requirement (AV:P), which is the dominant risk-limiting factor. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Dell ThinOS 10 to version 2605_10.2616 or later, as specified in Dell security advisory DSA-2026-389 (https://www.dell.com/support/kbdoc/en-us/000502746/dsa-2026-389-security-update-for-dell-thinos-10-for-multiple-vulnerabilities). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in Dell ThinOS 10 (versions prior to 2605_10.2616) allows an unauthenticated remote attacker to in
Analysis complete. Summary of what I produced and flagged: **CVE-2026-81048 — Dell ThinOS 10 command injection (CWE-77)
Arbitrary code execution in Dell ThinOS 10 (all builds prior to 2605_10.2616) allows a remote, unauthenticated attacker
OS command injection in Dell ThinOS 10 (all builds prior to 2605_10.2616) lets a high-privileged remote attacker execute
Improper access control in Dell ThinOS 10 (all versions prior to 2605_10.2518) enables a local low-privileged user to by
Local privilege escalation in Dell ThinOS 10 versions prior to ThinOS10 2602_10.0765 allows a low-privileged user with l
Unauthorized access in Dell ThinOS 10 (versions prior to 2605_10.2100) stems from an obsolete UI feature (CWE-448) that
Dell ThinOS 10 firmware allows a low-privileged attacker with physical device access to overwrite the Security Version N
Physical access to Dell ThinOS 10 endpoints running versions prior to ThinOS10 2602_10.0765 allows an unauthenticated at
Protection mechanism failure in Dell ThinOS 10 (versions prior to 2605_10.2100) allows an unauthenticated attacker with
Arbitrary code execution in Dell ThinOS 10 (all builds prior to 2605_10.2616) is enabled by a missing integrity check (C
Same weakness CWE-494 – Download of Code Without Integrity Check
View allShare
External POC / Exploit Code
Leaving vuln.today