Buffer Overflow Vulnerability in Dell ControlVault3 and ControlVault3 Plus
CVE-2025-24922

8.8HIGH

Key Information:

Vendor

Broadcom
Status
Bcm5820x
Controlvault3
Controlvault3 Plus
Vendor
CVE Published:
13 June 2025

What is CVE-2025-24922?

A stack-based buffer overflow vulnerability affects the securebio_identify functionality within the Dell ControlVault3 and ControlVault3 Plus systems. This vulnerability occurs due to improper handling of specially crafted malicious cv_object data, which can be exploited by an attacker to execute arbitrary code through a series of crafted API calls. This could potentially allow unauthorized access or control over affected devices, posing significant security risks.

Affected Version(s)

BCM5820X NA

ControlVault3 0 < 5.15.10.14

ControlVault3 Plus 0 < 6.2.26.36

References

https://www.dell.com/support/kbdoc/en-us/000276106/dsa-20...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Philippe Laulheret of Cisco Talos
.
CVE-2025-24922 : Buffer Overflow Vulnerability in Dell ControlVault3 and ControlVault3 Plus