Volerion logoVolerion
Volerion logoVolerion

Dell ControlVault3 and ControlVault3 Plus Deserialization Vulnerability Leading to Arbitrary Code Execution

Vulnerability

A deserialization vulnerability allowing arbitrary code execution exists in Dell ControlVault3 versions prior to 5.15.10.14 and in ControlVault3 Plus versions prior to 6.2.26.36. The issue arises in the 'cvhDecapsulateCmd' function, where a specially crafted response from ControlVault can be exploited. An attacker could compromise ControlVault firmware to create a malicious response that triggers this vulnerability.

Impact

Exploitation of this vulnerability could lead to unauthorized arbitrary code execution on the affected system.

Remediation

Users can update to Dell ControlVault3 version 5.15.10.14 or later, or to Dell ControlVault3 Plus version 6.2.26.36 or later. Instructions for downloading the updated versions are available on the Dell Drivers & Downloads site.

Added: Jun 13, 2025, 10:25 PM
Updated: Jun 13, 2025, 10:25 PM

Vulnerability Rating

Custom Algorithm
spread
5.4
impact
7.5
exploitability
4.7
remediation
7.7
relevance
0.2
threat
0.0
urgency
2.9
incentive
0.8

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.