The vulnerability is an Improper Neutralization of Special Elements used in a Command, also referred to as Command Injection (CWE-77). A local attacker with low privileged access can supply specially crafted input to bypass command sanitization and execute arbitrary system commands, resulting in elevation of privileges on the device. The affected component that processes local user inputs is where the vulnerability resides, inferred from the description of the command processing context.

Affected product: Dell ThinOS 10. All versions prior to ThinOS 2602_10.0573 are vulnerable. The vulnerability requires local access; no remote exploitation is documented.

The CVSS score of 7.8 indicates a high severity, and the EPSS score is not available, so exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, which reduces immediate threat signals. Nonetheless, because the attack vector is local and only low‑privileged access is needed, internal users or compromised local accounts are the primary risk. The likely attack vector is local, inferred from the mention of local low‑privileged access.