CVE-2025-43728 is a critical (CVSS 9.6) protection mechanism failure in Dell ThinOS 10 versions before 2508_10.0127. An unauthenticated attacker with remote access could potentially bypass a protection mechanism. The fix is ThinOS 10 build 2508_10.0127 or later, per Dell security advisory DSA-2025-331.
What's affected
The record lists Dell ThinOS 10 versions prior to 2508_10.0127, and the affected hardware list includes Dell Latitude models such as the 3330, 3420, 3440, 3450, 5440, 5450, 5520 and 5530, with more in the full record.
Dell's advisory is DSA-2025-331. I could not retrieve it while preparing this post, so use the advisory for the complete model table and for the exact update packages. The fixed build named in the record is 2508_10.0127.
The vector lists network access, low complexity, no privileges and user interaction required, with changed scope. The record says no more about the mechanism than that a protection mechanism can be bypassed.
How to check if you're exposed
Check the ThinOS version on a device in its system information screen, or in the management console that your team uses to manage thin clients. Compare it with 2508_10.0127.
For a fleet, export the device list and versions from the management console and filter for anything older. Pay attention to devices that have been offline or in storage, since they miss scheduled updates.
Confirm that the model is on Dell's affected list in the advisory, since the advisory scopes the issue by ThinOS 10 and by model.
What to do now
- Export an inventory of ThinOS devices with their versions.
- Read Dell advisory DSA-2025-331 and download the package for each affected model.
- Update a pilot group, confirm that sessions to your virtual desktop broker still work, then roll out in waves.
- Bring offline and stored devices on the network briefly to update them before reuse.
- Keep thin clients on a segment with limited reach to internal systems.
- Record the minimum allowed ThinOS version in your device policy.
Why it matters
The class is protection mechanism failure, CWE-693 (Protection Mechanism Failure). A safeguard that should stop an action does not work under some conditions, so the intended boundary can be crossed. The record does not describe which protection is affected, so the advisory is the place to learn the detail.
Thin clients are trusted endpoints to virtual desktops, so a weakness in the client can sit in front of credentials and sessions. The changed scope in the vector hints that the impact can extend beyond the device itself.
The record does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list. Because these devices often live outside patch cycles, a fixed build plus an inventory is the sensible response.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which ThinOS build fixes it?
The record says versions prior to 2508_10.0127 are affected. Use that build or later, and confirm the package for your model in Dell advisory DSA-2025-331.
Do I need user interaction for an attacker to succeed?
The vector marks user interaction as required, so it is not fully hands off. Still treat it as urgent given the 9.6 score.
Sources
Last reviewed: 18 October 2026.
