Attacker could defeat Dell firmware flaws with a vegetable
Over 100 models of Dell laptop PCs across the enterprise-centric Lattitude and Precision ranges, and many thousands of individual devices, are at risk of compromise through a series of five common vulnerabilities and exposures (CVEs) that affect their security firmware and associated Microsoft Windows application programming interfaces (APIs), according to a new disclosure from the Cisco Talos threat lab.
Collectively dubbed ReVault by the Talos researchers who discovered it, the vulnerabilities can be used by a malicious actor to maintain access to the victim device even if Windows has been reinstalled, and can also be used as a physical compromise to bypass Windows Login, or enable a local user to obtain admin or system-level rights.
According to Phillipe Laulheret, a senior vulnerability researcher at Cisco Talos, the vulnerabilities centre on the hardware-based ControlVault3 solution that manages passwords, biometric templates and other security codes within the device firmware on a daughter board, which Dell refers to as a Unified Security Hub (USH). This hub can be used to connect peripheral security devices, like a fingerprint reader or near-field communications (NFC) device.
In a blog post, Laulheret wrote that vulnerabilities on ControlVault USHs were potentially highly dangerous.
“These laptop models are widely-used in the cyber security industry, government settings and challenging environments in their rugged version. Sensitive industries that require heightened security when logging in – via smartcard or NFC – are more likely to find ControlVault devices in their environment, as they are necessary to enable these security features,” he explained.
The five newly-published CVEs are tracked as CVE-2025-24311 and CVE-2025-25050, both out-of-bounds flaws, an arbitrary free vulnerability tracked as CVE-2025-25215, and a stack overflow bug tracked as CVE-2025-24922. The fifth issue affecting ControlVault’s Windows APIs is an unsafe deserialisation flaw tracked as CVE-2025-24919.
Spring onions: the newest cyber attack vector
The Talos disclosure detailed a number of potential exploitation scenarios. For example, an attacker with limited rights could interact with the ControlVault firmware via its APIs to trigger arbitrary code execution on the firmware, from where they could steal key material that could be used to permanently modify said firmware. This would enable them to establish persistence, unnoticed by the victim, and pivot back to do more damage down the line.
In a different scenario, a local attacker who had managed to gain physical access to a laptop could open the body and directly access the USH via a universal serial bus (USB) connection, at which point the other four vulnerabilities would all become exploitable, with no need for the attacker to have logged onto the system or to have obtained a full-disk encryption password.
If the system was configured to accept a fingerprint when logging on, it would also be possible to tamper with the firmware to that it would accept any input, including non-human ones such as vegetables; a video posted by Cisco shows a spring onion being used to unlock a vulnerable laptop.
Next steps for salad dodgers
The spring onion demo being an amusing ‘first’ for the cyber security industry, the ReVault flaws clearly do have serious impacts, said Cisco Talos, and demonstrate the importance of evaluating the security of hardware components, which can be overlooked in comparison to software flaws.
Organisations are advised to ensure the latest firmware is installed – which can be done via Windows Update – or via Dell. If organisations are not using any security peripherals, it may be worth disabling ControlVault services in the Service Manager or the device itself in Device Manager.
To avoid the spring onion attack if this is a concern, security teams may also wish to consider disabling fingerprint-based login in situations where risks may be heightened, or by activating Windows Enhanced Sign-in Security (ESS).
For attack detection, depending on the model of device it can be possible to detect a chassis intrusion via the Basic Input/Output System (BIOS). Security teams can also look for unexpected Windows Biometric Service or Credential Vault crashes in the device logs, and anybody using Cisco Secure Endpoint can use the signature definition ‘bcmbipdll.dll Loaded by Abnormal Process’.
Dell released updates addressing the ReVault vulnerabilities on 13 June and advised customers at that time.
“Working with our firmware provider, we addressed the issues quickly and transparently disclosed the reported vulnerabilities in accordance with our Vulnerability Response Policy,” a spokesperson told Computer Weekly.
“Customers can review the Dell Security Advisory DSA-2025-053 for information on affected products, versions, and more. As always, it is important that customers promptly apply security updates that we make available and move to supported versions of our products to ensure their systems remain secure,” they said.
Dell added: “Collaborating with industry partners and the research community on coordinated disclosures is a key part of strengthening the security of our products and advancing the broader technology industry.”
Source link
