CVE-2025-24311 Dell ControlVault3/ControlVault3 Plus cv_send_blockdata out-of-bounds read vulnerability
An attacker can trigger an out-of-bounds read in Dell ControlVault firmware via a crafted API call, leading to information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-24311?
CVE-2025-24311 is a high-severity vulnerability in Broadcom BCM5820X, published on 13 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An out-of-bounds read vulnerability exists in the cv_send_blockdata functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call can lead to an information leak. An attacker can issue an API call to trigger this vulnerability.
Weakness: CWE-125
Which versions are affected by CVE-2025-24311?
How do I fix CVE-2025-24311?
No fix has been published for CVE-2025-24311 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-24311 being exploited?
There is no known exploitation of CVE-2025-24311 in the wild and no public exploit code.
Sources
Also known as GHSA-5v6x-pfc7-q9g6.