CVE-2025-31361 Overview
CVE-2025-31361 is a privilege escalation vulnerability in the Dell ControlVault Windows Biometric Driver Interface (WBDI) driver. The flaw resides in the WBIO_USH_ADD_RECORD functionality of Dell ControlVault3 firmware. A specially crafted WinBioControlUnit API call triggers the vulnerability, allowing a local authenticated attacker to escalate privileges. The underlying weakness is classified as [CWE-908] Use of Uninitialized Resource. Dell ControlVault3 versions prior to 5.15.14.19 and Dell ControlVault3 Plus versions prior to 6.2.36.47 are affected.
Critical Impact
A local attacker with low privileges can invoke a Windows Biometric Framework API call to gain elevated privileges on affected Dell endpoints, resulting in high impact to confidentiality and integrity.
Affected Products
- Dell ControlVault3 firmware prior to 5.15.14.19
- Dell ControlVault3 Plus firmware prior to 6.2.36.47
- Dell endpoints shipping with ControlVault WBDI driver
Discovery Timeline
- 2025-11-17 - CVE-2025-31361 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-31361
Vulnerability Analysis
The vulnerability affects the WBIO_USH_ADD_RECORD handler within the Dell ControlVault WBDI driver. ControlVault is a hardware-based credential store that manages biometric templates, smart card credentials, and other authentication material on Dell business systems. The WBDI driver exposes this functionality to the Windows Biometric Framework through kernel and user-mode components.
An attacker sends a crafted WinBioControlUnit API call that reaches the vulnerable record-add path. Because the driver operates in a privileged context, successful exploitation crosses a security boundary. The CVSS scope change reflects this transition, since the vulnerable component and the impacted component differ.
Root Cause
The root cause is a Use of Uninitialized Resource weakness [CWE-908]. The WBIO_USH_ADD_RECORD function processes attacker-controlled input without ensuring that the associated memory or resource is fully initialized before use. When the uninitialized data influences privileged operations, an attacker can manipulate the outcome to achieve privilege escalation.
Attack Vector
Exploitation requires local access with low privileges. No user interaction is needed. The attacker issues a crafted WinBioControlUnit call from user mode. The request is routed through the Windows Biometric Framework to the ControlVault WBDI driver, where the vulnerable WBIO_USH_ADD_RECORD code path executes. See the Talos Intelligence Vulnerability Report for the disassembly-level analysis.
No public proof-of-concept exploit is available at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS estimate remains low.
Detection Methods for CVE-2025-31361
Indicators of Compromise
- Unexpected loading or reloading of the Dell ControlVault WBDI driver on endpoints where biometric enrollment is not in use
- Non-administrative processes issuing WinBioControlUnit calls outside of standard Windows Biometric Framework workflows
- Local user accounts spawning elevated processes shortly after interacting with winbio.dll or WbioSrvc
Detection Strategies
- Inventory endpoints for vulnerable Dell ControlVault3 firmware versions below 5.15.14.19 and ControlVault3 Plus below 6.2.36.47 using asset management or EDR telemetry
- Alert on unsigned or unusual processes invoking Windows Biometric Framework APIs, particularly WinBioControlUnit
- Correlate low-integrity process activity with subsequent creation of high-integrity or SYSTEM-level processes on the same host
Monitoring Recommendations
- Monitor Windows Biometric Service (WbioSrvc) events and driver load events for anomalies
- Track process ancestry to identify local privilege escalation chains originating from user-mode applications
- Ingest endpoint telemetry into a centralized data lake for retrospective hunting once vendor detection signatures are released
How to Mitigate CVE-2025-31361
Immediate Actions Required
- Update Dell ControlVault3 firmware to version 5.15.14.19 or later, and Dell ControlVault3 Plus firmware to 6.2.36.47 or later, per Dell Security Advisory DSA-2025-228
- Prioritize patching on multi-user workstations, kiosks, and shared endpoints where local low-privilege access is more accessible to attackers
- Restrict local logon rights on Dell devices until firmware updates are deployed
Patch Information
Dell has published fixed firmware in Dell Security Advisory DSA-2025-228. Apply the vendor-provided ControlVault firmware updater package through Dell Command Update, Windows Update, or standard patch management tooling. Reboot the endpoint after installation to complete driver replacement.
Workarounds
- Disable ControlVault services and biometric authentication on affected endpoints if patching cannot be performed immediately
- Remove or restrict access to fingerprint readers and smart card readers that rely on the ControlVault WBDI driver
- Enforce least-privilege on local accounts and require multi-factor authentication for privileged operations
# Example: query installed ControlVault driver version on a Windows endpoint
pnputil /enum-drivers | findstr /I "ControlVault WBDI"
# Verify firmware version reported by Dell tooling before and after update
dcu-cli.exe /scan -report=C:\Temp\dcu-report.xml
dcu-cli.exe /applyUpdates -reboot=enable
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
