PT-2025-47226 · Dell · Dell Controlvault3 Plus+1

Philippe Laulheret · Published 2025-11-17 · Updated 2025-11-18 · CVE-2025-31649

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Dell ControlVault3 versions prior to 5.15.14.19 Dell ControlVault3 Plus versions prior to 6.2.36.47

Description A hard-coded password exists within the ControlVault WBDI Driver functionality. An attacker can exploit this by issuing a specially crafted ControlVault API call, potentially leading to the execution of privileged operations. The API call triggers the vulnerability, allowing attackers to bypass security measures.

Recommendations Update Dell ControlVault3 to version 5.15.14.19 or later. Update Dell ControlVault3 Plus to version 6.2.36.47 or later.

Fix

LPE

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

CVE-2025-31649

Affected Products

Dell Controlvault3

Dell Controlvault3 Plus

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-31649 · Security Note
• https://talosintelligence.com/vulnerability_reports/TALOS-2025-2173 · Note
• https://twitter.com/CVEnew/status/1990559387358806141 · Twitter Post
• https://twitter.com/CveTodo/status/1990563160995086595 · Twitter Post
• https://twitter.com/CveFindCom/status/1990565727674225035 · Twitter Post
• https://dell.com/support/kbdoc/en-us/000326061/dsa-2025-228 · Note
• https://twitter.com/ZeroPathLabs/status/1990662214018007427 · Twitter Post
• https://t.me/CVEtracker/37553 · Telegram Post
• https://twitter.com/RedPacketSec/status/1990734584644841796 · Twitter Post