← CVE Intelligence

CVE-2025-24919

Dell ControlVault3/ControlVault3 Plus deserialization of untrusted input vulnerability PUBLISHED

Description (CNA)

A deserialization of untrusted input vulnerability exists in the cvhDecapsulateCmd functionality of Dell ControlVault3 prior to 5.15.10.14 and ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault response to a command can lead to arbitrary code execution. An attacker can compromise a ControlVault firmware and have it craft a malicious response to trigger this vulnerability.

Affected (CNA)

Vendor / productVersions
Broadcom / BCM5820Xaffected NA
Dell / ControlVault3affected 0 before 5.15.10.14
Dell / ControlVault3 Plusaffected 0 before 6.2.26.36

CWE

CWE-502

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.