Home

Description

A deserialization of untrusted input vulnerability exists in the cvhDecapsulateCmd functionality of Dell ControlVault3 prior to 5.15.10.14 and ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault response to a command can lead to arbitrary code execution. An attacker can compromise a ControlVault firmware and have it craft a malicious response to trigger this vulnerability.

PUBLISHED Reserved 2025-02-20 | Published 2025-06-13 | Updated 2026-02-26 | Assigner talos




HIGH: 8.1CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Problem types

CWE-502 Deserialization of Untrusted Data

Product status

Default status
unaffected

NA
affected

Default status
unaffected

Any version before 5.15.10.14
affected

Default status
unaffected

Any version before 6.2.26.36
affected

Credits

Discovered by Philippe Laulheret of Cisco Talos. finder

References

www.talosintelligence.com/...ability_reports/TALOS-2025-2153

www.dell.com/support/kbdoc/en-us/000276106/dsa-2025-053

cve.org (CVE-2025-24919)

nvd.nist.gov (CVE-2025-24919)

Download JSON