CVE-2025-24919
Dell ControlVault3/ControlVault3 Plus deserialization of untrusted input vulnerability
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Dell ControlVault3/ControlVault3 Plus deserialization of untrusted input vulnerability
A deserialization of untrusted input vulnerability exists in the cvhDecapsulateCmd functionality of Dell ControlVault3 prior to 5.15.10.14 and ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault response to a command can lead to arbitrary code execution. An attacker can compromise a ControlVault firmware and have it craft a malicious response to trigger this vulnerability.
Reserved 2025-02-20 | Published 2025-06-13 | Updated 2025-06-13 | Assigner talosCWE-502 Deserialization of Untrusted Data
Discovered by Philippe Laulheret of Cisco Talos.
www.dell.com/support/kbdoc/en-us/000276106/dsa-2025-053
Support options
