EUVD-2025-18302

The vulnerability exists in the cv_upgrade_sensor_firmware API handler within Dell's ControlVault firmware management subsystem. CWE-787 (Out-of-bounds Write) indicates that the vulnerable code fails to properly validate input parameters or enforce buffer boundaries when processing API requests related to sensor firmware upgrades. This results in a write operation that accesses memory locations outside the intended buffer, potentially corrupting adjacent memory structures, heap metadata, or enabling code execution. The ControlVault products are hardware security modules/trusted platform management solutions, and the affected function is likely responsible for processing firmware upgrade payloads without adequate input validation or size checks. The API-based attack vector suggests the vulnerability can be triggered programmatically without requiring direct binary exploitation or kernel-level access.