Skip to content
CVE PROGRAM SOURCE RECORD8.1 High

CVE-2025-24919

Dell ControlVault3/ControlVault3 Plus deserialization of untrusted input vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
talos

Description

A deserialization of untrusted input vulnerability exists in the cvhDecapsulateCmd functionality of Dell ControlVault3 prior to 5.15.10.14 and ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault response to a command can lead to arbitrary code execution. An attacker can compromise a ControlVault firmware and have it craft a malicious response to trigger this vulnerability.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Broadcom BCM5820X

Default version status: unaffected

  • NAaffected

Dell ControlVault3

Default version status: unaffected

  • 0 to < 5.15.10.14affected

Dell ControlVault3 Plus

Default version status: unaffected

  • 0 to < 6.2.26.36affected

References