Dell ControlVault3 Driver Vulnerability (DSA-2025-053)

#%NASL_MIN_LEVEL 70300
#
# (C) Tenable, Inc.
#

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(245964);
  script_version("1.8");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/07");

  script_cve_id(
    "CVE-2025-24311",
    "CVE-2025-25050",
    "CVE-2025-25215",
    "CVE-2025-24922",
    "CVE-2025-24919"
  );
  script_xref(name:"IAVA", value:"2025-A-0585-S");

  script_name(english:"Dell ControlVault3 Driver Vulnerability (DSA-2025-053)");

  script_set_attribute(attribute:"synopsis", value:
"The Dell ControlVault3 cvusbdrv.sys driver is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of the Dell ControlVault3 cvusbdrv.sys driver installed on the remote host is 5.x prior to 
5.15.10.14, or 6.x prior to 6.2.26.36. It is, therefore, affected by multiple vulnerabilities as referenced 
in the vendor advisory:

  - An out-of-bounds write vulnerability exists in the cv_upgrade_sensor_firmware functionality of Dell 
    ControlVault3 prior to 5.15.10.14 and Dell ControlVault 3 Plus prior to 6.2.26.36. A specially crafted 
    ControlVault API call can lead to an out-of-bounds write. An attacker can issue an API call to trigger this 
    vulnerability. (CVE-2025-25050)
    
  - A deserialization of untrusted input vulnerability exists in the cvhDecapsulateCmd functionality of Dell 
    ControlVault3 prior to 5.15.10.14 and ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault 
    response to a command can lead to arbitrary code execution. An attacker can compromise a ControlVault firmware 
    and have it craft a malicious response to trigger this vulnerability. (CVE-2025-24919)
      
  - A stack-based buffer overflow vulnerability exists in the securebio_identify functionality of Dell 
    ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted 
    malicious cv_object can lead to a arbitrary code execution. An attacker can issue an API call to trigger this 
    vulnerability.  (CVE-2025-24922)
    
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.dell.com/support/kbdoc/en-us/000276106/dsa-2025-053?lwp=rt");
  script_set_attribute(attribute:"solution", value:
"Upgrade the Dell ControlVault3 driver and firmware to version 5.15.10.14 / 6.2.26.36 or higher.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-25050");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/08/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/08/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/08/08");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"x-cpe:/a:dell:controlvault3_driver");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("dell_controlvault3_driver_win_installed.nbin");
  script_require_keys("WMI/SystemDrivers/Enumerated", "BIOS/Manufacturer", "BIOS/Model");

  exit(0);
}

include('vcf.inc');
include('vcf_extras.inc');

var app_info = vcf::get_app_info(app:'Dell ControlVault3 Driver');

if (!isnull(app_info['Driver Version']))
  app_info['version'] = app_info['Driver Version'];

app_info['parsed_version'] = vcf::parse_version(app_info['version']);

vcf::check_granularity(app_info:app_info, sig_segments:4);

var affected_dell_models = [
  'Latitude 5300 2-in-1',
  'Latitude 5300',
  'Latitude 5310 2-in-1',
  'Latitude 5310',
  'Latitude 5320',
  'Latitude 5330',
  'Latitude 5340',
  'Latitude 5350',
  'Latitude 5400',
  'Latitude 5410',
  'Latitude 5411',
  'Latitude 5420',
  'Latitude 5421',
  'Latitude 5430',
  'Latitude 5430 Rugged',
  'Latitude 5431',
  'Latitude 5440',
  'Latitude 5450',
  'Latitude 5500',
  'Latitude 5501',
  'Latitude 5510',
  'Latitude 5511',
  'Latitude 5520',
  'Latitude 5521',
  'Latitude 5530',
  'Latitude 5531',
  'Latitude 5540',
  'Latitude 5550',
  'Latitude 7030 Rugged Extreme',
  'Latitude 7200 2-in-1',
  'Latitude 7210 2-in-1',
  'Latitude 7220 Rugged Extreme',
  'Latitude 7230 Rugged Extreme',
  'Latitude 7300',
  'Latitude 7310',
  'Latitude 7320',
  'Latitude 7320 Detachable',
  'Latitude 7330',
  'Latitude 7330 Rugged Laptop',
  'Latitude 7340',
  'Latitude 7350',
  'Latitude 7350 Detachable',
  'Latitude 7400',
  'Latitude 7400 2-In-1',
  'Latitude 7410',
  'Latitude 7420',
  'Latitude 7430',
  'Latitude 7440',
  'Latitude 7450',
  'Latitude 7520',
  'Latitude 7530',
  'Latitude 7640',
  'Latitude 7650',
  'Latitude 9330',
  'Latitude 9410',
  'Latitude 9420',
  'Latitude 9430',
  'Latitude 9440 2-in-1',
  'Latitude 9450',
  'Latitude 9510 2in1',
  'Latitude 9520',
  'Latitude Rugged 7220EX',
  'Precision 3470',
  'Precision 3480',
  'Precision 3490',
  'Precision 3540',
  'Precision 3541',
  'Precision 3550',
  'Precision 3551',
  'Precision 3560',
  'Precision 3561',
  'Precision 3570',
  'Precision 3571',
  'Precision 3580',
  'Precision 3581',
  'Precision 3590',
  'Precision 3591',
  'Precision 5470',
  'Precision 5480',
  'Precision 5490',
  'Precision 5680',
  'Precision 5690',
  'Precision 7540',
  'Precision 7550',
  'Precision 7560',
  'Precision 7670',
  'Precision 7680',
  'Precision 7740',
  'Precision 7750',
  'Precision 7760',
  'Precision 7770',
  'Precision 7780',
  'Pro 13 Plus PB13250',
  'Pro 14 Plus PB14250',
  'Pro 16 Plus PB16250',
  'Pro Max 14 MC14250',
  'Pro Max 16 MC16250',  
  'Pro Rugged 13 RA13250',
  'Pro Rugged 14 RB14250'
];

# special check to ignore unaffected dell models
# https://www.dell.com/support/kbdoc/en-us/000276106/dsa-2025-053?lwp=rt
var bios_manufacturer = get_kb_item_or_exit('BIOS/Manufacturer');
var dell_model = get_kb_item_or_exit('BIOS/Model');
var constraints;

if (bios_manufacturer =~ "^[Dd]ell [Ii]nc" &&
  !collib::contains(affected_dell_models, dell_model))
  audit(AUDIT_DEVICE_NOT_VULN, dell_model);

if (!empty_or_null(app_info))
{
  # DUP package versions differ from the installed driver file (cvusbdrv.sys) version.
  # 5.x: DUP 5.15.10.14 ships cvusbdrv.sys 5.15.9.9. Confirmed via Dell driver page G7K77
  #      and by customer scan KB showing Driver Version=5.15.9.9 on a patched host.
  # 6.x: DUP 6.2.26.36 (ControlVault3 Plus) ships driver 6.2.9.3 / firmware 6.2.024.
  #      Confirmed by Playwright extraction of .inf files and manifests from the Dell DUP.
  # When Driver Version is present, compare against the driver file threshold to avoid FPs
  # on hosts where the package version exceeds the driver file version (RES-223237/CS-81541).
  if (!isnull(app_info['Driver Version']) && app_info['version'] =~ "^5\.")
    constraints = [{ 'min_version': '5', 'fixed_version': '5.15.9.9' }];
  else if (!isnull(app_info['Driver Version']) && app_info['version'] =~ "^6\.")
    constraints = [{ 'min_version': '6', 'fixed_version': '6.2.9.3' }];
  else if (app_info['version'] =~ "^6\.")
    constraints = [{ 'min_version': '6', 'fixed_version': '6.2.26.36' }];
  else if (app_info['version'] =~ "^5\.")
    constraints = [{ 'min_version': '5', 'fixed_version': '5.15.10.14' }];
}

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);