Introduction
Attackers can escalate from a standard user to system privileges on over 100 Dell Latitude and Precision models by abusing a flaw in the ControlVault3 security module. The flaw sits in hardware that enterprises trust to protect biometric data and credentials, so organizations relying on Dell's security stack should treat it as a high priority.
Dell Technologies is a major enterprise and consumer hardware vendor, with millions of Latitude and Precision laptops deployed worldwide. The ControlVault3 security module is built on Broadcom's BCM5820X chip and is central to Dell's hardware-based credential and biometric protection. A vulnerability in this module affects endpoint security in sectors such as government, finance, and healthcare.
Technical information
CVE-2025-31361 is a privilege escalation vulnerability in the WBIO_USH_ADD_RECORD functionality of the ControlVault WBDI (Windows Biometric Device Interface) Driver. The driver does not sufficiently validate parameters passed through the WinBioControlUnit API call. A local attacker with low privileges can send a crafted API request that triggers the flaw and gain system or administrative privileges. The attack needs no user interaction, and its complexity is low.
The vulnerability is classified as CWE-908 (Use of Uninitialized Resource). That classification suggests the driver processes uninitialized memory or resources when it handles the WBIO_USH_ADD_RECORD operation, which opens unintended code execution paths. Exploitation is local. The attacker needs code execution on the target system but does not need administrative access to start the attack. The vulnerable code is in the driver layer that interfaces with the Broadcom-based ControlVault3 hardware, which manages biometric and credential storage.
CVE-2025-31361 belongs to ReVault, a broader group of vulnerabilities that includes multiple critical flaws in ControlVault3 firmware and drivers. Among them are out-of-bounds writes, buffer overflows, and deserialization flaws. An attacker could chain any of these for more complex attacks or for persistence.
Affected systems and versions
- Dell ControlVault3 prior to version 5.15.14.19
- Dell ControlVault3 Plus prior to version 6.2.36.47
- Affected product lines include Dell Latitude 5000 and 7000 series, Precision 3000 series, and Dell Pro models
- A system is vulnerable when the affected driver and firmware versions are installed and active
Vendor security history
External researchers, most notably Cisco Talos, have found multiple critical vulnerabilities in Dell ControlVault3. The ReVault group (CVE-2025-24311, CVE-2025-25215, CVE-2025-24922, CVE-2025-25050, CVE-2025-24919) points to recurring problems with validation in the firmware and drivers. Dell has responded with coordinated advisories and timely patch releases. Still, the fact that outside researchers had to find flaws this critical suggests Dell's pre-release security validation has room to improve, especially for hardware security modules.
