Dell ThinOS 10 firmware versions prior to 2605_10 and 2616 contain a flaw that allows unsafe handling of special characters in OS command strings. The improper neutralization of command elements enables an attacker to inject arbitrary commands, potentially giving them full control over the device's operating system. The description notes that an attacker with high privileges and remote access could exploit the flaw to execute arbitrary commands. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, suggesting no known public exploitation yet. Nonetheless, the potential for remote command execution remains a significant threat to any exposed ThinOS device.

Dell ThinOS 10 devices running firmware older than 2605_10 or 2616 are affected. The vulnerability applies to all editions of ThinOS 10 that have not been updated to the corrected release. No additional vendor or product details were provided in the CVE record.

The CVSS score of 9.1 signals a high‑severity threat. The lack of an EPSS score indicates no known exploitation at the time of analysis, and its absence from the CISA KEV catalog further supports that it has not been actively exploited publicly. Nevertheless, an attacker with high privileges and remote access could use the command injection vector to execute arbitrary OS commands. Successful exploitation would grant full control over the device, compromising confidentiality, integrity, and availability. The primary attack vector is remote interaction with the ThinOS device over its network interfaces, and the vulnerability can be leveraged by attackers who have obtained or bypassed local credentials, or by those who can directly access the privileged interface via remote management protocols.