CVE-2025-25215

CWE-763 CWE-617 — Reachable Assertion4 documents4 sources

Severity

8.8HIGH

EPSS

0.1%

top 68.87%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Dell Controlvault3 Dell Controlvault3 Plus Broadcom Bcm5820x

Timeline

PublishedJun 13

Latest updateJun 14

Description

An arbitrary free vulnerability exists in the cv_close functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call can lead to an arbitrary free. An attacker can forge a fake session to trigger this vulnerability.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HExploitability: 2.0 | Impact: 6.0

Affected Packages3 packages

▶CVEListV5dell/controlvault3_plus< 6.2.26.36

▶CVEListV5dell/controlvault3< 5.15.10.14

▶CVEListV5broadcom/bcm5820xNA

🔴Vulnerability Details

GHSA

GHSA-j6h7-76gh-2j3r: An arbitrary free vulnerability exists in the cv_close functionality of Dell ControlVault3 prior to 5↗2025-06-14

▶

CVEList

Dell ControlVault3/ControlVault3 Plus cv_close arbitrary free vulnerability↗2025-06-13

▶

📋Vendor Advisories

Microsoft

An assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itself↗2021-04-13

▶