PT-2025-47213 · Dell · Dell Controlvault3 Plus+1

Philippe Laulheret · CVE-2025-32089 · Published 2025-11-17 · Updated 2025-11-18

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell ControlVault3 versions prior to 5.15.14.19 Dell ControlVault3 Plus versions prior to 6.2.36.47

Description A buffer overflow exists in the CvManager SBI functionality. A specially crafted ControlVault API call can lead to arbitrary code execution. An attacker can issue an API call to trigger this issue. The vulnerability arises from improper handling of API calls to the ControlVault API.

Recommendations Dell ControlVault3 versions prior to 5.15.14.19 should be updated to version 5.15.14.19 or later. Dell ControlVault3 Plus versions prior to 6.2.36.47 should be updated to version 6.2.36.47 or later.

Fix

LPE

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2025-32089

Affected Products

Dell Controlvault3

Dell Controlvault3 Plus

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-32089 · Security Note
• https://twitter.com/VulmonFeeds/status/1990621067207950420 · Twitter Post
• https://twitter.com/CVEnew/status/1990553397393756535 · Twitter Post
• https://twitter.com/CveFindCom/status/1990565703728906521 · Twitter Post
• https://twitter.com/RedPacketSec/status/1990734585957666939 · Twitter Post
• https://t.me/CVEtracker/37554 · Telegram Post
• https://twitter.com/transilienceai/status/1990623986741326136 · Twitter Post
• https://talosintelligence.com/vulnerability_reports/TALOS-2025-2188 · Note
• https://dell.com/support/kbdoc/en-us/000326061/dsa-2025-228 · Note
• https://twitter.com/CveTodo/status/1990564656125968409 · Twitter Post
• https://twitter.com/ZeroPathLabs/status/1990662217109217337 · Twitter Post