Dell Storage Manager XXE (CVE-2025-22478)

Binary data dellstoragemanagercve-2025-22478.nbin...

Dell SupportAssist OS Recovery Privilege Elevation Vulnerability

Dell SupportAssist OS Recovery is a Dell USA company that provides a recovery environment that contains tools for diagnosing and resolving problems that may occur before the computer boots into the operating system. A security vulnerability exists in Dell SupportAssist OS Recovery Temporary File...

Dell RecoverPoint for Virtual Machines Weak File System Permissions Vulnerability

Dell RecoverPoint for Virtual Machines is Dell's disaster recovery solution for VMware virtual environments, designed to simplify data protection and disaster recovery processes for virtual machines and ensure business continuity. Dell RecoverPoint for Virtual Machines is vulnerable to a weak fil...

Linux Distros Unpatched Vulnerability : CVE-2023-53056

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Synchronize the IOCB count to be in order A system hang was observed with the...

Dell PowerProtect Data Domain OS Command Injection Vulnerability (CNVD-2025-22717)

Dell PowerProtect Data Domain Dell PowerProtect DD is a suite of hardware appliances for data protection, backup, storage, and deduplication from Dell, USA. A security vulnerability exists in Dell PowerProtect Data Domain, which can be exploited by an attacker to cause arbitrary commands to be...

Dell Unity svc_nas Utility OS Command Injection Vulnerability

Dell Unity is a set of virtual Unity storage environments from Dell USA. An operating system command injection vulnerability exists in Dell Unity 5.5 and prior versions, which stems from the svcnas utility program failing to properly filter construct command special characters, commands, etc. An...

Dell Digital Delivery Information Disclosure Vulnerability

Dell Digital Delivery is a digital software delivery service offered by Dell that allows users to shop for and automatically download and install paid software e.g., Microsoft Office, Photoshop, etc. in tandem with the purchase of a Dell computer. An information disclosure vulnerability exists in...

The vulnerability of the recovery environment in Dell SupportAssist OS Recovery, due to insufficient protection of operational data, allows a perpetrator to disclose protected information.

The vulnerability of the recovery environment in Dell SupportAssist OS Recovery is related to insufficient protection for operational data. Exploiting this vulnerability can allow attackers to disclose protected information...

Dell Unity svc_nfssupport utility OS command injection vulnerability

Dell Unity is a set of virtual Unity storage environments from Dell USA. An operating system command injection vulnerability exists in Dell Unity 5.5 and prior versions, which stems from the svcnfssupport utility failing to properly filter construct command special characters, commands, etc. An...

The vulnerability of the recovery environment in Dell SupportAssist OS Recovery, related to the creation of temporary files with insecure permissions, allows a malicious actor to escalate their privileges.

The vulnerability of the recovery environment in Dell SupportAssist OS Recovery relates to the creation of temporary files with insecure permissions. Exploiting this vulnerability can allow an attacker to increase their privileges...

Dell Unity Cross-Site Scripting Vulnerability (CNVD-2025-18244)

Dell Unity is a set of virtual Unity storage environments from Dell USA. A cross-site scripting vulnerability exists in Dell Unity 5.5 and earlier versions, which stems from the application's lack of effective filtering and escaping of user-supplied data, and can be exploited by an attacker to...

DELL Enterprise SONiC OS Encryption Key Vulnerability

DELL Enterprise SONiC OS is an open source network operating system developed by Dell and designed for data center and cloud computing scenarios. DELL Enterprise SONiC OS suffers from a cryptographic key vulnerability that stems from a cryptographic key vulnerability in SSH, which can be exploite...

Dell PowerProtect Data Domain OS Command Injection Vulnerability (CNVD-2025-22716)

Dell PowerProtect Data Domain Dell PowerProtect DD is a suite of hardware appliances for data protection, backup, storage, and deduplication from Dell, USA. A security vulnerability exists in Dell PowerProtect Data Domain, which can be exploited by an attacker to potentially cause arbitrary...

Dell PowerProtect Data Domain Operating System Command Injection Vulnerability

Dell PowerProtect Data Domain Dell PowerProtect DD is a suite of hardware appliances for data protection, backup, storage, and deduplication from Dell, USA. A security vulnerability exists in Dell PowerProtect Data Domain, which can be exploited by an attacker to execute arbitrary commands...

Dell Unity OS Command Injection Vulnerability

Dell Unity is a mid-range hybrid flash storage platform from Dell that supports a wide range of workloads, including files and data blocks, and offers flexible deployment options and modern management capabilities. Dell Unity suffers from an operating system command injection vulnerability that c...

Researchers Reveal ReVault Attack Targeting Dell ControlVault3 Firmware in 100+ Laptop Models

Cybersecurity researchers have uncovered multiple security flaws in Dell's ControlVault3 firmware and its associated Windows APIs that could have been abused by attackers to bypass Windows login, extract cryptographic keys, as well as maintain access even after a fresh operating system install by...

ReVault! When your SoC turns against you… deep dive edition

For a high-level overview of this research, you can refer to our Vulnerability Spotlight. This is the in-depth version that shares many more technical details. In this post, we'll be covering the entire research process as well as providing technical explanations of the exploits behind the attack...

Dell ControlVault3 cv_upgrade_sensor_firmware out-of-bounds write vulnerability

Talos Vulnerability Report TALOS-2025-2137 Dell ControlVault3 cvupgradesensorfirmware out-of-bounds write vulnerability August 9, 2025 CVE Number CVE-2025-25050 SUMMARY An out-of-bounds write vulnerability exists in the cvupgradesensorfirmware functionality of Dell ControlVault3 5.14.3.0. A...

Dell ControlVault3 cvhDecapsulateCmd improper input validation vulnerability

Talos Vulnerability Report TALOS-2025-2153 Dell ControlVault3 cvhDecapsulateCmd improper input validation vulnerability August 9, 2025 CVE Number CVE-2025-24919 SUMMARY A deserialization of untrusted input vulnerability exists in the cvhDecapsulateCmd functionality of Dell ControlVault3 prior to...

Dell ControlVault3 cv_close arbitrary free vulnerability

Talos Vulnerability Report TALOS-2024-2129 Dell ControlVault3 cvclose arbitrary free vulnerability August 9, 2025 CVE Number CVE-2025-25215 SUMMARY An arbitrary free vulnerability exists in the cvclose functionality of Dell ControlVault3 5.14.3.0. A specially crafted ControlVault API call can lea...