CVE-2025-24919 Dell ControlVault3/ControlVault3 Plus deserialization of untrusted input vulnerability
A deserialization flaw in Dell ControlVault firmware allows arbitrary code execution if an attacker compromises the firmware to send malicious responses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-24919?
CVE-2025-24919 is a high-severity unsafe deserialization vulnerability in Broadcom BCM5820X, published on 13 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A deserialization of untrusted input vulnerability exists in the cvhDecapsulateCmd functionality of Dell ControlVault3 prior to 5.15.10.14 and ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault response to a command can lead to arbitrary code execution. An attacker can compromise a ControlVault firmware and have it craft a malicious response to trigger this vulnerability.
Weakness: CWE-502
Which versions are affected by CVE-2025-24919?
How do I fix CVE-2025-24919?
No fix has been published for CVE-2025-24919 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2025-24919 being exploited?
There is no known exploitation of CVE-2025-24919 in the wild and no public exploit code.
Sources
Also known as GHSA-fvxq-m6wq-rqqv.