‘ReVault’ Flaws in Dell Security Firmware Threaten Over 100 Laptop Models

Security researchers at Cisco Talos have uncovered five critical vulnerabilities in Dell’s ControlVault3 firmware that affect more than 100 models of Latitude and Precision laptops. Collectively dubbed “ReVault,” the flaws could allow attackers to bypass Windows login protections, access sensitive data, and maintain persistent control over affected systems—even after a complete operating system reinstallation.

Vulnerabilities in Hardware-Based Security Components

The flaws affect the Broadcom BCM5820X secure processor embedded within Dell’s ControlVault3 firmware. This chip is designed to store sensitive authentication data – including passwords, biometric templates, and security codes – in a hardware-isolated environment, separate from the host operating system. By targeting this secure element, attackers can undermine some of the most fundamental protections built into enterprise-grade Dell laptops.

Cisco Talos identified five specific vulnerabilities: an out-of-bounds read condition (CVE-2025-24311), an out-of-bounds write flaw (CVE-2025-25050), an arbitrary memory free bug (CVE-2025-25215), a stack-based buffer overflow (CVE-2025-24922), and an unsafe deserialization issue in ControlVault’s Windows APIs (CVE-2025-24919). These flaws were discovered through internal research and reported to both Dell and Broadcom in advance of public disclosure.

According to Talos, the vulnerabilities create a range of high-impact security risks. An attacker who gains initial access to a target system could exploit the flaws to extract stored passwords and biometric data, bypass the Windows login process, and deploy malware that remains on the device even after a fresh installation of the operating system. Because the vulnerabilities compromise hardware-level protections, they offer attackers an unusually persistent foothold that traditional endpoint security solutions may not detect or remove.

Impact and Mitigation

Philippe Laulheret, the lead Cisco Talos researcher on the project, said the vulnerabilities are especially dangerous because they undermine the very hardware security features designed to protect sensitive environments. He explained that the flaws expose a new attack surface and could allow stealthy, long-term access that persists beyond OS-level remediation.

Dell acknowledged the issue in its official security advisory, DSA-2025-053, and issued updates to the affected ControlVault3 firmware and drivers between March and May 2025. Users of vulnerable Latitude and Precision models are urged to install the updates without delay. Dell’s advisory includes a full list of impacted devices, which are widely used across government, corporate, and cybersecurity-focused organizations.

While there are no confirmed cases of active exploitation at the time of publication, the discovery of ReVault highlights growing concerns around firmware-level threats. These kinds of vulnerabilities are difficult to detect, patch, and defend against, particularly when they affect core components of a system’s trusted computing base.

Sources: Cybersecurity News, Cyberinsider, Bleeping Computer

–

By Ali Nassar-Smith