CVE-2025-26331
Published: 07 March 2025
Summary
CVE-2025-26331 is a high-severity Command Injection (CWE-77) vulnerability in Dell Thinos. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked at the 41.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 directly prevents command injection by requiring validation of inputs to neutralize special elements before command execution.
SI-2 mitigates the vulnerability by identifying, patching, and remediating the specific command injection flaw in Dell ThinOS.
AC-6 limits the impact of arbitrary code execution by enforcing least privilege on the low-privileged local attacker.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection vulnerability enables local low-privileged arbitrary code execution via Unix shell and facilitates privilege escalation.
NVD Description
Dell ThinOS 2411 and prior, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution.
Deeper analysisAI
CVE-2025-26331 is an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability, classified under CWE-77, affecting Dell ThinOS versions 2411 and prior. Published on 2025-03-07, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.
A low-privileged attacker with local access can exploit this vulnerability to achieve arbitrary code execution. The attack requires local access and low privileges but no user interaction, with effects confined to the local scope.
Dell Security Advisory DSA-2025-107 at https://www.dell.com/support/kbdoc/en-us/000289886/dsa-2025-107 and INCIBE-CERT early alert at https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2025-26331 provide further details on the vulnerability and mitigation steps.
Details
- CWE(s)