CVE-2025-25215 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Description

An arbitrary free vulnerability exists in the cv_close functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call can lead to an arbitrary free. An attacker can forge a fake session to trigger this vulnerability.

Reserved 2025-02-06 | Published 2025-06-13 | Updated 2025-06-13 | Assigner talos

HIGH: 8.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Problem types

CWE-763 Release of Invalid Pointer or Reference

Product status

Default status

unaffected

NA

affected

Default status

unaffected

Any version before 5.15.10.14

affected

Default status

unaffected

Any version before 6.2.26.36

affected

Credits

Discovered by Philippe Laulheret of Cisco Talos. finder

References

www.dell.com/support/kbdoc/en-us/000276106/dsa-2025-053

cve.org (CVE-2025-25215)

nvd.nist.gov (CVE-2025-25215)

Download JSON

https://cve.threatint.eu/CVE/CVE-2025-25215

Support options

Helpdesk Chat, Email, Knowledgebase