CVE-2025-31649 - CVE House
Back to Database
Status published High CVE-2025-31649

Dell ControlVault3 ControlVault WBDI Driver hard-coded password vulnerability

Vulnerability Description

A hard-coded password vulnerability exists in the ControlVault WBDI Driver functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted ControlVault API call can lead to execute priviledged operation. An attacker can issue an api call to trigger this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-31649

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Discovered by Philippe Laulheret of Cisco Talos.

References

More from Broadcom

View All →
CVE-2025-9059
Elevation of Privileges Vulnerability in IT Management Suite
High 8.8
CVE-2025-8661
Stored Cross-Site Scripting in Symantec PGP Encryption 11.0.1
Medium 4.6
CVE-2025-8660
Privilege Escalation in Symantec PGP Encryption 11.0.1
Medium 5.6
CVE-2025-7398
Medium Strength Cipher Suites detected on port on ports 9000 and 8036
High 8.6
CVE-2025-7397
CLI history displays inline passwords
Medium 6.8

Affected Vendor

Affected Software

BCM5820X, ControlVault3, ControlVault3 Plus
Vulnerable Versions:
NA, 0

Timeline

Official Publish: November 17th, 2025
Last Modified: February 26th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Weaknesses (CWE)

CWE-908

MITRE ATT&CK TTPs

T1203 Exploitation for Client Execution
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1499.003 Application Exhaustion Flood
Impact