Out-of-Bounds Write Vulnerability in Dell ControlVault Products
CVE-2025-25050

8.8HIGH

Key Information:

Vendor

Broadcom
Status
Bcm5820x
Controlvault3
Controlvault3 Plus
Vendor
CVE Published:
13 June 2025

What is CVE-2025-25050?

A vulnerability exists in the firmware upgrade functionality of Dell ControlVault 3 and 3 Plus products where an out-of-bounds write can be triggered through specially crafted API calls. This flaw can potentially allow attackers to manipulate memory beyond intended boundaries, posing significant security risks and leading to unauthorized actions within the device.

Affected Version(s)

BCM5820X NA

ControlVault3 0 < 5.15.10.14

ControlVault3 Plus 0 < 6.2.26.36

References

https://www.dell.com/support/kbdoc/en-us/000276106/dsa-20...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Discovered by Philippe Laulheret of Cisco Talos.
.
CVE-2025-25050 : Out-of-Bounds Write Vulnerability in Dell ControlVault Products