Millions of Dell laptops are are at risk thanks to a Broadcom chip vulnerability – and more than 100 device models are impacted
Widely used in high-security environments, the PCs are vulnerable to attacks allowing the theft of sensitive data
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
You are now subscribed
Your newsletter sign-up was successful
Millions of Dell laptops with Broadcom chips are vulnerable to attack if left unpatched, thanks to firmware vulnerabilities that could allow hackers to steal sensitive data.
Dell ControlVault is system-on-chip (SoC), a hardware-based security solution that stores passwords, biometric templates and security codes within the firmware.
It does this via a daughter board, which Dell refers to as a Unified Security Hub (USH). This is used as a hub to run ControlVault (CV), connecting various security peripherals such as a fingerprint reader, smart card reader and NFC reader.
Designed to provide enhanced security, CV is widely used by cybersecurity companies, government agencies, and other highly security-conscious organizations.
However, according to Cisco Talos researchers, more than 100 Dell laptop models are affected by five vulnerabilities, dubbed ReVault, which affect both the ControlVault3 firmware and its associated Windows APIs.
The flaws include multiple out-of-bounds vulnerabilities, an arbitrary free and a stack-overflow, all affecting the CV firmware, as well as an unsafe-deserialization that affects ControlVault’s Windows APIs.
"These findings highlight the importance of evaluating the security posture of all hardware components within your devices, not just the operating system or software," said Cisco Talos senior vulnerability researcher Philippe Laulheret.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
"As Talos demonstrated, vulnerabilities in widely-used firmware such as Dell ControlVault can have far-reaching implications, potentially compromising even advanced security features like biometric authentication."
What the vulnerability means for users
If left unpatched, said Cisco Talos, the vulnerabilities could allow attackers to take full control of a user’s device, steal passwords and access sensitive data such as fingerprint information.
Attack scenarios include privilege escalation, persistent access even after OS reinstallation and exploitation via physical tampering.
"On the Windows side, a non-administrative user can interact with the CV firmware using its associated APIs and trigger an Arbitrary Code Execution on the CV firmware,” said Laulheret
“From this vantage point, it becomes possible to leak key material essential to the security of the device, thus gaining the ability to permanently modify its firmware.”
"This creates the risk of a so-called implant that could stay unnoticed in a laptop’s CV firmware and eventually be used as a pivot back onto the system in the case of a Threat Actor’s post-compromise strategy,” Laulheret added.
Meanwhile, any local attacker with physical access to a user’s laptop could pry it open and directly access the USH board over USB with a custom connector - allowing them to exploit the vulnerabilities without needing to log in into the system or have a full-disk encryption password.
Dell has issued a security advisory on the flaws, DSA-2025-053, and has patches for affected systems. Users are advised to apply these patches, disable any unused services and consider disabling fingerprint login when laptops are likely to be left unattended.
Dell and Broadcom have been approached for comment.
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
- INSERT CONTENT
Emma Woollacott is a freelance journalist writing for publications including the BBC, Private Eye, Forbes, Raconteur and specialist technology titles.
-
How the rise of the AI ‘agent boss’ is reshaping accountability in ITIn-depth As IT companies deploy more autonomous AI tools and agents, the task of managing them is becoming more concentrated and throwing role responsibilities into doubt
-
Hackers are pouncing on enterprise weak spots as AI expands attack surfacesNews Potent new malware strains, faster attack times, and the rise of shadow AI are causing havoc
-
‘They are able to move fast now’: AI is expanding attack surfaces – and hackers are looking to reap the same rewards as enterprises with the technologyNews Potent new malware strains, faster attack times, and the rise of shadow AI are causing havoc
-
Ransomware gangs are using employee monitoring software as a springboard for cyber attacksNews Two attempted attacks aimed to exploit Net Monitor for Employees Professional and SimpleHelp
-
Notepad++ hackers remained undetected and pushed malicious updates for six months – here’s who’s responsible, how they did it, and how to check if you’ve been affectedNews Hackers remained undetected for months and distributed malicious updates to Notepad++ users after breaching the text editor software – here's how to check if you've been affected.
-
CISA’s interim chief uploaded sensitive documents to a public version of ChatGPT – security experts explain why you should never do thatNews The incident at CISA raises yet more concerns about the rise of ‘shadow AI’ and data protection risks
-
Former Google engineer convicted of economic espionage after stealing thousands of secret AI, supercomputing documentsNews Linwei Ding told Chinese investors he could build a world-class supercomputer
-
90% of companies are woefully unprepared for quantum security threats – analysts say they need to get a move onNews Quantum security threats are coming, but a Bain & Company survey shows systems aren't yet in place to prevent widespread chaos
-
LastPass issues alert as customers targeted in new phishing campaignNews LastPass has urged customers to be on the alert for phishing emails amidst an ongoing scam campaign that encourages users to backup vaults.
-
‘Resilience debt’ is now one of the most pressing cyber challenges for enterprises – here's what it means and how you can tackle itNews Research from Dell Technologies suggests the gap between cyber resilience and perception of readiness is getting bigger
