Broadcom Bcm5820X vulnerabilities

CVE-2025-36460 [HIGH] CWE-805 CVE-2025-36460: Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted WinBioControlUnit call can lead to memory corruption. An attacker can issue an api call to trigger this vulnerab

CVE-2025-36462 [HIGH] CWE-805 CVE-2025-36462: Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted WinBioControlUnit call can lead to memory corruption. An attacker can issue an api call to trigger this vulnerab

CVE-2025-36553 [HIGH] CWE-120 CVE-2025-36553: A buffer overflow vulnerability exists in the CvManager functionality of Dell ControlVault3 prior to A buffer overflow vulnerability exists in the CvManager functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted ControlVault API call can lead to memory corruption. An attacker can issue an api call to trigger this vulnerability.

CVE-2025-32089 [HIGH] CWE-120 CVE-2025-32089: A buffer overflow vulnerability exists in the CvManager_SBI functionality of Dell ControlVault3 prio A buffer overflow vulnerability exists in the CvManager_SBI functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted ControlVault API call can lead to a arbitrary code execution. An attacker can issue an api call to trigger this vulnerability.

CVE-2025-36461 [HIGH] CWE-805 CVE-2025-36461: Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted WinBioControlUnit call can lead to memory corruption. An attacker can issue an api call to trigger this vulnerab

CVE-2025-31361 [HIGH] CWE-908 CVE-2025-31361: A privilege escalation vulnerability exists in the ControlVault WBDI Driver WBIO_USH_ADD_RECORD func A privilege escalation vulnerability exists in the ControlVault WBDI Driver WBIO_USH_ADD_RECORD functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted WinBioControlUnit call can lead to privilege escalation. An attacker can issue an api call to trigger this vulnerability.

CVE-2025-36463 [HIGH] CWE-805 CVE-2025-36463: Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted WinBioControlUnit call can lead to memory corruption. An attacker can issue an api call to trigger this vulnerab

CVE-2025-31649 [HIGH] CWE-908 CVE-2025-31649: A hard-coded password vulnerability exists in the ControlVault WBDI Driver functionality of Dell Con A hard-coded password vulnerability exists in the ControlVault WBDI Driver functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted ControlVault API call can lead to execute priviledged operation. An attacker can issue an api call to trigger this vulnerability.

CVE-2025-24922 [HIGH] CWE-121 CVE-2025-24922: A stack-based buffer overflow vulnerability exists in the securebio_identify functionality of Dell A stack-based buffer overflow vulnerability exists in the securebio_identify functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted malicious cv_object can lead to a arbitrary code execution. An attacker can issue an API call to trigger this vulnerability.

CVE-2025-24311 [HIGH] CWE-125 CVE-2025-24311: An out-of-bounds read vulnerability exists in the cv_send_blockdata functionality of Dell ControlVa An out-of-bounds read vulnerability exists in the cv_send_blockdata functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call can lead to an information leak. An attacker can issue an API call to trigger this vulnerability.

CVE-2025-25050 [HIGH] CWE-787 CVE-2025-25050: An out-of-bounds write vulnerability exists in the cv_upgrade_sensor_firmware functionality of Dell An out-of-bounds write vulnerability exists in the cv_upgrade_sensor_firmware functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault 3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call can lead to an out-of-bounds write. An attacker can issue an API call to trigger this vulnerability.

CVE-2025-24919 [HIGH] CWE-502 CVE-2025-24919: A deserialization of untrusted input vulnerability exists in the cvhDecapsulateCmd functionality of A deserialization of untrusted input vulnerability exists in the cvhDecapsulateCmd functionality of Dell ControlVault3 prior to 5.15.10.14 and ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault response to a command can lead to arbitrary code execution. An attacker can compromise a ControlVault firmware and have it craft a maliciou

CVE-2025-25215 [HIGH] CWE-763 CVE-2025-25215: An arbitrary free vulnerability exists in the cv_close functionality of Dell ControlVault3 prior to An arbitrary free vulnerability exists in the cv_close functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call can lead to an arbitrary free. An attacker can forge a fake session to trigger this vulnerability.