EUVD-2025-18303CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
A stack-based buffer overflow vulnerability exists in the securebio_identify functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted malicious cv_object can lead to a arbitrary code execution. An attacker can issue an API call to trigger this vulnerability.
Analysis
Stack-based buffer overflow vulnerability in Dell ControlVault3's securebio_identify functionality that allows local attackers with low privileges to execute arbitrary code with high impact across the system. The vulnerability affects ControlVault3 versions prior to 5.15.10.14 and ControlVault3 Plus versions prior to 6.2.26.36, and can be triggered via a specially crafted API call with a malicious cv_object parameter.
Technical Context
This vulnerability exists in the securebio_identify API function of Dell ControlVault3, a credential and identity management solution. The root cause is a classic stack-based buffer overflow (CWE-121: Stack-based Buffer Overflow), where insufficient input validation on the cv_object parameter allows an attacker to write beyond allocated stack memory boundaries. ControlVault3 is a security application that manages biometric and credential data; the securebio_identify function likely processes biometric identification requests. The affected CPE strings are: cpe:2.3:a:dell:controlvault3:*:*:*:*:*:*:*:* (versions <5.15.10.14) and cpe:2.3:a:dell:controlvault3_plus:*:*:*:*:*:*:*:* (versions <6.2.26.36). Stack-based overflows are particularly dangerous because they can overwrite return addresses and local variables, enabling direct code execution control.
Affected Products
Dell ControlVault3 (All versions prior to 5.15.10.14); Dell ControlVault3 Plus (All versions prior to 6.2.26.36)
Remediation
- action: Immediate Patching; details: Update Dell ControlVault3 to version 5.15.10.14 or later. Update Dell ControlVault3 Plus to version 6.2.26.36 or later. Patches should be deployed through Dell's security advisory channels. - action: Access Control; details: Implement strict local access controls to ControlVault3-enabled systems. Restrict user account privileges to minimum necessary levels. Disable or restrict API access to the securebio_identify function for untrusted local users. - action: Input Validation; details: Until patches are applied, implement endpoint detection and response (EDR) solutions configured to detect stack buffer overflow exploitation patterns and suspicious securebio_identify API calls with oversized cv_object parameters. - action: Monitoring; details: Monitor system logs for abnormal calls to securebio_identify API endpoints, unexpected privilege escalations on ControlVault3 systems, and segmentation fault/crash events in ControlVault3 processes. - action: Vendor Advisory; details: Consult Dell's official security advisory for CVE-2025-24922 for detailed patch availability, compatibility notes, and rollback procedures. Check dell.com/support for the latest security bulletins.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today