PT-2025-47215 · Dell · Dell Controlvault3 Plus+1

Philippe Laulheret · Published 2025-11-17 · Updated 2025-11-18 · CVE-2025-36553

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell ControlVault3 versions prior to 5.15.14.19 Dell ControlVault3 Plus versions prior to 6.2.36.47

Description A buffer overflow issue exists in the CvManager functionality. A specially crafted ControlVault API call can lead to memory corruption. An attacker can issue an API call to trigger this issue. The vulnerability occurs due to improper handling of crafted API calls, allowing an attacker to send a malicious API request that exceeds the expected memory boundaries during processing. This can lead to memory corruption.

Recommendations Dell ControlVault3 versions prior to 5.15.14.19 should be updated. Dell ControlVault3 Plus versions prior to 6.2.36.47 should be updated.

Fix

LPE

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2025-36553

Affected Products

Dell Controlvault3

Dell Controlvault3 Plus

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-36553 · Security Note
• https://twitter.com/RedPacketSec/status/1990734587278885068 · Twitter Post
• https://talosintelligence.com/vulnerability_reports/TALOS-2025-2189 · Note
• https://twitter.com/CVEnew/status/1990553400745029822 · Twitter Post
• https://twitter.com/CveTodo/status/1990565290216767847 · Twitter Post
• https://twitter.com/CveFindCom/status/1990565651170074816 · Twitter Post
• https://dell.com/support/kbdoc/en-us/000326061/dsa-2025-228 · Note
• https://twitter.com/ZeroPathLabs/status/1990662214659846325 · Twitter Post
• https://t.me/CVEtracker/37559 · Telegram Post