Cyber Posture

CVE-2025-26331

High

Published: 07 March 2025

Published
07 March 2025
Modified
01 July 2025
KEV Added
—
Patch
—
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0019 41.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

Security Summary

CVE-2025-26331 is an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability, classified under CWE-77, affecting Dell ThinOS versions 2411 and prior. Published on 2025-03-07, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.

A low-privileged attacker with local access can exploit this vulnerability to achieve arbitrary code execution. The attack requires local access and low privileges but no user interaction, with effects confined to the local scope.

Dell Security Advisory DSA-2025-107 at https://www.dell.com/support/kbdoc/en-us/000289886/dsa-2025-107 and INCIBE-CERT early alert at https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2025-26331 provide further details on the vulnerability and mitigation steps.

Details

CWE(s)
CWE-77

Affected Products

dell
thinos
≤ 2411

MITRE ATT&CK Enterprise Techniques

T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Command injection vulnerability enables local low-privileged arbitrary code execution via Unix shell and facilitates privilege escalation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References