Introduction
Remote attackers can bypass core security controls on Dell ThinOS 10 thin clients, which puts enterprise and healthcare environments at significant risk. CVE-2025-43728, disclosed in August 2025, is a critical protection mechanism failure in ThinOS 10 versions prior to 2508_10.0127. Organizations with Dell thin client deployments need to deal with it immediately.
Dell ThinOS is an operating system built for thin clients and is widely used in healthcare, finance, and government. Dell is a major global IT vendor with a large presence in endpoint infrastructure. Organizations rely on ThinOS devices for secure access to virtual desktops and cloud applications, so a vulnerability in this platform hits especially hard for anyone who depends on secure remote access.
Technical Information
CVE-2025-43728 is classified as a Protection Mechanism Failure (CWE-693) in Dell ThinOS 10. It allows an unauthenticated remote attacker to bypass protection mechanisms. The specific technical details, such as the affected service or code path, have not been made public, and no code snippets or detailed exploitation flows are available yet. The vulnerability is critical because the attack is remote and unauthenticated, and because an attacker could circumvent core security controls on affected devices.
Affected Systems and Versions
- Dell ThinOS 10, versions prior to 2508_10.0127
- All configurations of ThinOS 10 before this version are vulnerable
Vendor Security History
ThinOS has had critical vulnerabilities before. CVE-2020-29491 and CVE-2020-29492 (both CVSS 10.0) affected ThinOS 8.6 and earlier and allowed device takeover through insecure update mechanisms. More recently, CVE-2025-26331 and CVE-2025-27688 (CVSS 7.8) were reported in ThinOS 10, involving command injection and privilege escalation. Dell typically responds with security advisories and patches, but high-severity issues keep recurring, which points to ongoing problems in its secure development process.
