How does this security chip endanger millions of dell computers?

This is the type of paradox whose cybersecurity has the secret. Since August 5, 2025 and the publication of an alert note from Cisco Talos researchers, the Dell company must respond to a major risk that could affect millions of machines around the world.

The source of the problem? The material safety chip Controlvault3, which is supposed to provide increased protection to its users.

Designed by the manufacturer Broadcom, this chip is integrated into more than a hundred Dell computers models to play the role of digital safe: it isolates and protects ultra-sensitive elements such as passwords, smart or biometric data codes, in order to offer a maximum level of security, even in the event of Windows compromise.

Ultra-sensitive data that could potentially fall into the hands of hackers a little bit skillful.

Two possible attack scenarios

In the report, Cisco Talos researchers develop two scenarios.
First, that of software exploitation: an attacker, even without administrator privilege, can interact with the Controlvault3 chip via legitimate Windows interfaces.

Thanks to an “unsecured dereialization” vulnerability (notably CVE-2025-24919), the hacker would be capable of injecting arbitrary code into the firmware of the security module, that is to say the computer program integrated directly into the equipment of an electronic device.

This manipulation then allowed him to steal the cryptographic keys and modify the firmware of the chip. The striker would then obtain full and sustainable access, thus installing a stolen door which would survive any resettlement of the operating system or reset of the computer.

The second scenario, just as formidable, is physical exploitation. If a computer is left unattended, in a hotel room, for example, a malicious individual could open the chassis and access the internal port of controlvault3. Using a specific USB adapter, it would be able to make a change in the firmware without the need for any preliminary passwords or access access. This manipulation would be enough to deactivate disk encryption, recover or replace fingerprints, or reconfigure the machine to accept any finger with biometric authentication. Material diversion would then remain invisible to the user, especially since the intrusion detection of the case is only active if it has been previously configured.

High -risk users

If this second scenario may seem to be high -end spying, it should be kept in mind that the types of this kind of devices are working precisely in environments where security is crucial, as Philippe Laulheret, researcher at Talos to our colleagues from The Register points out: “These laptop models are widely used in the cybersecurity sector, in public administrations and in difficult environments. »»

Aware of the severity of the flaw and in order to give users time to protect themselves, the researchers have publicly published the technical details of these scenarios only once the dell corrective is disseminated.

Dell reacted without delay by publishing its security correction on June 13, inviting all the users concerned to update the Firmware of Controlvault3.

Pending the application of this update, the brand recommends in caution to deactivate biometric authentication on the posts exposed and to activate, when possible, the chassis opening systems via BIOS.