InfoSecBulletin Cybersecurity for mankind
More than 100 Dell laptop models in the Latitude and Precision series are vulnerable due to five common security issues affecting their firmware and Microsoft Windows APIs, according to a Cisco Talos report.
Talos researchers named the vulnerabilities ReVault. They allow an attacker to keep access to a victim’s device after Windows is reinstalled, bypass Windows Login, or grant a local user admin or system-level rights.
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
Phillipe Laulheret, a senior vulnerability researcher at Cisco Talos, states that the vulnerabilities are related to the hardware ControlVault3 solution. This solution manages passwords and biometric templates within the device firmware on a board known as the Unified Security Hub (USH) by Dell. The hub can connect security peripherals like fingerprint readers or NFC devices.
In a blog post, Laulheret wrote that vulnerabilities on ControlVault USHs were potentially highly dangerous.
“These laptop models are widely-used in the cyber security industry, government settings and challenging environments in their rugged version. Sensitive industries that require heightened security when logging in – via smartcard or NFC – are more likely to find ControlVault devices in their environment, as they are necessary to enable these security features,” he explained.
Five new CVEs have been published: CVE-2025-24311 and CVE-2025-25050 for out-of-bounds flaws, CVE-2025-25215 for an arbitrary free vulnerability, CVE-2025-24922 for a stack overflow, and CVE-2025-24919 for an unsafe deserialization issue in ControlVault’s Windows APIs.
The Talos disclosure outlined various potential exploitation scenarios. One example involves an attacker with limited access using ControlVault firmware APIs to execute arbitrary code, allowing them to steal keys to permanently alter the firmware. This would let them maintain persistence without the victim’s knowledge and cause further harm later.
Dell released updates addressing the ReVault vulnerabilities on 13 June and advised customers at that time.
“Working with our firmware provider, we addressed the issues quickly and transparently disclosed the reported vulnerabilities in accordance with our Vulnerability Response Policy,” a spokesperson told Computer Weekly.
“Customers can review the Dell Security Advisory DSA-2025-053 for information on affected products, versions, and more. As always, it is important that customers promptly apply security updates that we make available and move to supported versions of our products to ensure their systems remain secure,” they said.
Dell added: “Collaborating with industry partners and the research community on coordinated disclosures is a key part of strengthening the security of our products and advancing the broader technology industry.”
