Cybersecurity researchers at Cisco Talos have identified five critical vulnerabilities in Dell's ControlVault3 security firmware, collectively referred to as 'ReVault.' These vulnerabilities affect over 100 models of Dell laptops, primarily from the Latitude and Precision series, which are widely used in business environments, including government agencies and cybersecurity firms. The vulnerabilities allow attackers to remotely hijack systems and maintain persistent access, even after a complete reinstallation of Windows. According to Cisco Talos, 'The vulnerabilities can be exploited in so-called ReVault attacks,' enabling attackers with non-administrative privileges to leak key material and permanently modify firmware. 'These laptop models are widely used in the cybersecurity industry, government settings, and challenging environments,' stated Phillipe Laulheret, a senior vulnerability researcher at Cisco Talos. The identified vulnerabilities include two out-of-bounds vulnerabilities (CVE-2025-24311, CVE-2025-25050), an arbitrary free flaw (CVE-2025-25215), a stack overflow bug (CVE-2025-24922), and an unsafe deserialization flaw (CVE-2025-24919). These vulnerabilities exploit the Broadcom BCM5820X security chip embedded in Dell’s ControlVault3, which is responsible for managing sensitive information. Attackers who gain physical access to the device or have non-administrative access can exploit these vulnerabilities to bypass security measures. Dell has responded by issuing patches and advising users to review the Dell Security Advisory DSA-2025-053 for detailed information on affected products and versions. The company emphasized its commitment to transparency, stating, 'Working with our firmware provider, we addressed the issues quickly.' Although no known exploitation has occurred in the wild, experts stress the importance of applying security updates promptly to prevent potential threats. As a precautionary measure, organizations utilizing the affected Dell models are urged to implement the available patches immediately to secure their devices against these vulnerabilities.
