Dell PowerProtect Data Domain OS Command Injection Vulnerability (CNVD-2025-22716)

Dell PowerProtect Data Domain Dell PowerProtect DD is a suite of hardware appliances for data protection, backup, storage, and deduplication from Dell, USA. A security vulnerability exists in Dell PowerProtect Data Domain, which can be exploited by an attacker to potentially cause arbitrary...

Dell PowerProtect Data Domain Operating System Command Injection Vulnerability

Dell PowerProtect Data Domain Dell PowerProtect DD is a suite of hardware appliances for data protection, backup, storage, and deduplication from Dell, USA. A security vulnerability exists in Dell PowerProtect Data Domain, which can be exploited by an attacker to execute arbitrary commands...

Dell Unity Cross-Site Scripting Vulnerability (CNVD-2025-18244)

Dell Unity is a set of virtual Unity storage environments from Dell USA. A cross-site scripting vulnerability exists in Dell Unity 5.5 and earlier versions, which stems from the application's lack of effective filtering and escaping of user-supplied data, and can be exploited by an attacker to...

DELL Enterprise SONiC OS Encryption Key Vulnerability

DELL Enterprise SONiC OS is an open source network operating system developed by Dell and designed for data center and cloud computing scenarios. DELL Enterprise SONiC OS suffers from a cryptographic key vulnerability that stems from a cryptographic key vulnerability in SSH, which can be exploite...

Dell Unity OS Command Injection Vulnerability

Dell Unity is a mid-range hybrid flash storage platform from Dell that supports a wide range of workloads, including files and data blocks, and offers flexible deployment options and modern management capabilities. Dell Unity suffers from an operating system command injection vulnerability that c...

Researchers Reveal ReVault Attack Targeting Dell ControlVault3 Firmware in 100+ Laptop Models

Cybersecurity researchers have uncovered multiple security flaws in Dell's ControlVault3 firmware and its associated Windows APIs that could have been abused by attackers to bypass Windows login, extract cryptographic keys, as well as maintain access even after a fresh operating system install by...

ReVault! When your SoC turns against you… deep dive edition

For a high-level overview of this research, you can refer to our Vulnerability Spotlight. This is the in-depth version that shares many more technical details. In this post, we'll be covering the entire research process as well as providing technical explanations of the exploits behind the attack...

Dell ControlVault3 cv_upgrade_sensor_firmware out-of-bounds write vulnerability

Talos Vulnerability Report TALOS-2025-2137 Dell ControlVault3 cvupgradesensorfirmware out-of-bounds write vulnerability August 9, 2025 CVE Number CVE-2025-25050 SUMMARY An out-of-bounds write vulnerability exists in the cvupgradesensorfirmware functionality of Dell ControlVault3 5.14.3.0. A...

Linux Distros Unpatched Vulnerability : CVE-2025-38412

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks After...

Dell ControlVault3 cv_close arbitrary free vulnerability

Talos Vulnerability Report TALOS-2024-2129 Dell ControlVault3 cvclose arbitrary free vulnerability August 9, 2025 CVE Number CVE-2025-25215 SUMMARY An arbitrary free vulnerability exists in the cvclose functionality of Dell ControlVault3 5.14.3.0. A specially crafted ControlVault API call can lea...

Dell ControlVault3 securebio_identify stack-based buffer overflow vulnerability

Talos Vulnerability Report TALOS-2024-2130 Dell ControlVault3 securebioidentify stack-based buffer overflow vulnerability August 9, 2025 CVE Number CVE-2025-24922 SUMMARY A stack-based buffer overflow vulnerability exists in the securebioidentify functionality of Dell ControlVault3 5.14.3.0. A...

Dell ControlVault3 cv_send_blockdata out-of-bounds read vulnerability

Talos Vulnerability Report TALOS-2024-2127 Dell ControlVault3 cvsendblockdata out-of-bounds read vulnerability August 9, 2025 CVE Number CVE-2025-24311 SUMMARY An out-of-bounds read vulnerability exists in the cvsendblockdata functionality of Dell ControlVault3 5.14.3.0. A specially crafted...

Dell ControlVault3 cvhDecapsulateCmd improper input validation vulnerability

Talos Vulnerability Report TALOS-2025-2153 Dell ControlVault3 cvhDecapsulateCmd improper input validation vulnerability August 9, 2025 CVE Number CVE-2025-24919 SUMMARY A deserialization of untrusted input vulnerability exists in the cvhDecapsulateCmd functionality of Dell ControlVault3 prior to...

CVE-2025-38746

Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure...

CVE-2025-38747

Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contain a Creation of Temporary File With Insecure Permissions vulnerability. A local authenticated attacker could potentially exploit this vulnerability, leading to Elevation of Privileges...

Dell ControlVault3 Driver Detection (Windows)

Binary data dellcontrolvault3driverwininstalled.nbin...

Dell SupportAssist OS Recovery Multiple Vulnerabilities (DSA-2025-315)

According to its self-reported version number, the version of Dell SupportAssist OS Recovery is affected by Multiple Vulnerabilities. - Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contain a Creation of Temporary File With Insecure Permissions vulnerability. A local authenticated...

Dell ControlVault3 Driver Vulnerability (DSA-2025-053)

The version of the Dell ControlVault3 cvusbdrv.sys driver installed on the remote host is 5.x prior to 5.15.10.14, or 6.x prior to 6.2.26.36. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory: - An out-of-bounds write vulnerability exists in the...

The vulnerability of the Dell NetWorker backup and data recovery system lies in the choice of a less secure algorithm during configuration processes, allowing attackers to expose the protected information.

The vulnerability of the Dell NetWorker backup and recovery system lies in the choice of a less secure algorithm during configuration processes. Exploiting this vulnerability could allow an attacker, operating remotely, to expose the protected information...

CVE-2014-125113

An unrestricted file upload vulnerability exists in Dell acquired by Quest KACE K1000 System Management Appliance version 5.0 - 5.3, 5.4 prior to 5.4.76849, and 5.5 prior to 5.5.90547 in the downloadagent.php endpoint. An attacker can upload arbitrary PHP files to a temporary web-accessible...