Skip to content
OpenAdvisories
High WID-SEC-2025-1726 5 CVEs

Dell Computer: Mehrere Schwachstellen

Published Aug 5, 2025 · Updated Aug 7, 2025 · Revision 2 · de-DE

Vendor: Dell Product: Computer Platform: Windows

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen in Dell Computern in ControlVault3 ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu verursachen und Informationen offenzulegen. Je nach ihrer Position können Angreifer diese Schwachstellen miteinander verknüpfen, um die ControlVault-Firmware von Dell zu modifizieren, dauerhafte Hintertüren zu schaffen, die auch nach einer Neuinstallation des Betriebssystems bestehen bleiben, kryptografische Schlüssel zu extrahieren, beliebigen Code auszuführen und die Fingerabdruck-Authentifizierung zu umgehen.

Product

Dell Inc. ist ein Hersteller u. a. von Computern.

Vulnerabilities 5

  • High 8.8
    CVE-2025-24922

    Dell ControlVault3/ControlVault3 Plus securebio_identify stack-based buffer overflow vulnerability

    A stack-based buffer overflow vulnerability exists in the securebio_identify functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted malicious cv_object can lead to a arbitrary code execution…

    Dell Broadcom ControlVault3 BCM5820X
  • High 8.8
    CVE-2025-25050

    Dell ControlVault3/ControlVault3 Plus cv_upgrade_sensor_firmware out-of-bounds write vulnerability

    An out-of-bounds write vulnerability exists in the cv_upgrade_sensor_firmware functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault 3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call can lead to an out-of-bounds write…

    Dell Broadcom BCM5820X ControlVault3 Plus
  • High 8.8
    CVE-2025-25215

    Dell ControlVault3/ControlVault3 Plus cv_close arbitrary free vulnerability

    An arbitrary free vulnerability exists in the cv_close functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call can lead to an arbitrary free. An attacker can forge a fak…

    Dell Broadcom BCM5820X ControlVault3 Plus
  • High 8.4
    CVE-2025-24311

    Dell ControlVault3/ControlVault3 Plus cv_send_blockdata out-of-bounds read vulnerability

    An out-of-bounds read vulnerability exists in the cv_send_blockdata functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call can lead to an information leak. An attacker …

    Dell Broadcom ControlVault3 BCM5820X
  • High 8.1
    CVE-2025-24919

    Dell ControlVault3/ControlVault3 Plus deserialization of untrusted input vulnerability

    A deserialization of untrusted input vulnerability exists in the cvhDecapsulateCmd functionality of Dell ControlVault3 prior to 5.15.10.14 and ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault response to a command can lead to arbitrary …

    Dell Broadcom ControlVault3 Plus ControlVault3

Revision history

  1. #2

    Referenz(en) aufgenommen: DSA-2025-053

  2. #1

    Initiale Fassung

References