CVE-2025-24919: Dell ControlVault3 RCE Vulnerability

CVE-2025-24919 Overview

CVE-2025-24919 is an insecure deserialization vulnerability in the cvhDecapsulateCmd function of Dell ControlVault3 and ControlVault3 Plus. The flaw affects ControlVault3 versions prior to 5.15.10.14 and ControlVault3 Plus versions prior to 6.2.26.36. An attacker who has compromised the ControlVault firmware can craft a malicious response to a host command, leading to arbitrary code execution on the host. The vulnerability is tracked as CWE-502: Deserialization of Untrusted Data and carries a CVSS v3.1 base score of 8.1.

Critical Impact

A compromised ControlVault firmware can return crafted responses that achieve arbitrary code execution on the host with scope change, breaking the trust boundary between firmware and operating system.

Affected Products

• Dell ControlVault3 firmware prior to 5.15.10.14
• Dell ControlVault3 Plus firmware prior to 6.2.26.36
• Dell endpoint systems shipping with Broadcom-based ControlVault security hardware

Discovery Timeline

• 2025-06-13 - CVE-2025-24919 published to the National Vulnerability Database
• 2026-04-15 - Last updated in NVD database
• Vendor and researcher coordination details are documented in the Dell Security Advisory DSA-2025-053 and Talos Intelligence Vulnerability Report TALOS-2025-2153

Technical Details for CVE-2025-24919

Vulnerability Analysis

Dell ControlVault is a hardware-based security subsystem that stores credentials, fingerprint data, and smart card material in a dedicated secure processor. The host communicates with the ControlVault device through a command and response protocol handled by user-mode and kernel components on Windows. The cvhDecapsulateCmd function processes responses returned from the ControlVault firmware before they are consumed by higher-level services. Insufficient validation of the serialized response structure allows attacker-controlled data to be deserialized into trusted objects on the host. The result is arbitrary code execution in the host process that handles ControlVault communication.

Root Cause

The root cause is deserialization of untrusted input [CWE-502]. The host implicitly trusts data returned by the ControlVault firmware and does not enforce strict schema or type validation on the serialized response. When a malicious firmware image returns a crafted structure to cvhDecapsulateCmd, the decapsulation routine reconstructs objects from attacker-controlled bytes, enabling memory corruption or control-flow hijack.

Attack Vector

Exploitation requires the attacker to first compromise the ControlVault firmware itself. This is a local attack vector with high complexity, but it does not require any privileges or user interaction once firmware control is achieved. A malicious or modified firmware image responds to a legitimate host command with crafted serialized data. When the host processes the response, the deserialization flaw is triggered and code executes within the host context. Because the vulnerability spans a scope change between firmware and operating system, successful exploitation can be used as a persistence and privilege boundary crossing primitive following an initial firmware compromise.

No public exploit code or proof of concept is available at the time of writing. Technical write-ups are available in the Talos Intelligence Vulnerability Report TALOS-2025-2153.

Detection Methods for CVE-2025-24919

Indicators of Compromise

• Unexpected modifications to ControlVault firmware versions or signatures on Dell endpoints
• Crashes or anomalous termination of BCMBIPDLL.dll, WBF services, or other ControlVault host components
• Unsigned or downgraded ControlVault firmware images present on affected devices
• Unusual child processes spawned by ControlVault host services such as BcmBtRSupport or related Broadcom binaries

Detection Strategies

• Inventory ControlVault3 and ControlVault3 Plus firmware versions across the fleet and flag any system below 5.15.10.14 or 6.2.26.36
• Monitor for tampering with or replacement of Broadcom ControlVault host binaries and drivers on Dell endpoints
• Correlate firmware update events with administrative activity to surface unauthorized flashes

Monitoring Recommendations

• Enable endpoint logging for driver load events and firmware update operations on Dell hardware
• Forward firmware version telemetry to a central data lake for longitudinal comparison against the vendor baseline
• Alert on process injection or unusual memory operations targeting ControlVault host services

How to Mitigate CVE-2025-24919

Immediate Actions Required

• Apply the Dell firmware updates referenced in Dell Security Advisory DSA-2025-053 to bring ControlVault3 to 5.15.10.14 or later and ControlVault3 Plus to 6.2.26.36 or later
• Verify firmware integrity after patching and restrict local administrative access on affected endpoints
• Audit endpoints for prior firmware tampering before trusting the updated baseline

Patch Information

Dell has released fixed firmware versions through DSA-2025-053. Update ControlVault3 to version 5.15.10.14 or later and ControlVault3 Plus to version 6.2.26.36 or later. Updates are delivered through Dell Command Update and standard Dell firmware servicing channels. Validate that the host-side ControlVault drivers and services are updated in parallel with the firmware image to maintain protocol compatibility.

Workarounds

• Disable ControlVault-backed authentication features such as fingerprint and smart card readers on systems that cannot be patched immediately
• Restrict physical and local access to affected endpoints to reduce the opportunity for firmware compromise
• Enforce secure boot and measured boot policies so unauthorized firmware modifications are detected at startup

# Query ControlVault firmware version on Windows using Dell Command | Configure or PowerShell
Get-PnpDevice -FriendlyName "*ControlVault*" | Format-List FriendlyName, InstanceId, Status
Get-CimInstance Win32_PnPSignedDriver | Where-Object { $_.DeviceName -like "*ControlVault*" } | Select-Object DeviceName, DriverVersion