Dell ControlVault3 Deserialization via cvhDecapsulateCmd (pre-5.15.10.14 / pre-6.2.26.36)
CVE-2025-24919 Published on June 13, 2025
Dell ControlVault3/ControlVault3 Plus deserialization of untrusted input vulnerability
A deserialization of untrusted input vulnerability exists in the cvhDecapsulateCmd functionality of Dell ControlVault3 prior to 5.15.10.14 and ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault response to a command can lead to arbitrary code execution. An attacker can compromise a ControlVault firmware and have it craft a malicious response to trigger this vulnerability.
Vulnerability Analysis
CVE-2025-24919 can be exploited with local system access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is a Marshaling, Unmarshaling Vulnerability?
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVE-2025-24919 has been classified to as a Marshaling, Unmarshaling vulnerability or weakness.
Affected Versions
Broadcom BCM5820X:- Version NA is affected.
- Before 5.15.10.14 is affected.
- Before 6.2.26.36 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.