PT-2025-47225 · Dell · Dell Controlvault3 Plus+1

Philippe Laulheret · Published 2025-11-17 · Updated 2025-11-18 · CVE-2025-31361

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Dell ControlVault3 versions prior to 5.15.14.19 Dell ControlVault3 Plus versions prior to 6.2.36.47

Description A privilege escalation issue exists in the ControlVault WBDI Driver's WBIO USH ADD RECORD functionality. A crafted WinBioControlUnit call can allow an attacker to escalate privileges. The attacker issues an API call to trigger this issue.

Recommendations Dell ControlVault3 versions prior to 5.15.14.19 should be updated to version 5.15.14.19 or later. Dell ControlVault3 Plus versions prior to 6.2.36.47 should be updated to version 6.2.36.47 or later.

Fix

LPE

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

CVE-2025-31361

Affected Products

Dell Controlvault3

Dell Controlvault3 Plus

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-31361 · Security Note
• https://twitter.com/CveTodo/status/1990564219951906864 · Twitter Post
• https://talosintelligence.com/vulnerability_reports/TALOS-2025-2174 · Note
• https://twitter.com/RedPacketSec/status/1990659477419208748 · Twitter Post
• https://twitter.com/CVEnew/status/1990559388365361492 · Twitter Post
• https://twitter.com/CveFindCom/status/1990565752651333675 · Twitter Post
• https://t.me/CVEtracker/37552 · Telegram Post
• https://dell.com/support/kbdoc/en-us/000326061/dsa-2025-228 · Note
• https://twitter.com/ZeroPathLabs/status/1990662205419766065 · Twitter Post