Dell Control Vault, Lasso, GL.iNet vulnerabilities

Summary: Cisco Talos disclosed five vulnerabilities in Dell ControlVault 3 firmware and its Windows software, four in the Entr'ouvert Lasso C library, and one in the GL.iNet Slate AX travel router, all patched by their vendors. The Lasso flaws include a type confusion bug (CVE-2025-47151) where a crafted SAML response can lead to arbitrary code execution, plus three denial-of-service bugs (CVE-2025-46404, CVE-2025-46784, CVE-2025-46705) triggered by crafted SAML responses, while the Slate AX flaw (CVE-2025-44018) lets a crafted .tar file cause a firmware downgrade via man-in-the-middle attack.
Bottom line: Lasso handles federated identity and single sign-on, so a SAML response that reaches arbitrary code execution sits directly in the authentication path your organization depends on. The Slate AX issue requires a man-in-the-middle position, meaning anyone on the network path to a travel router can push its firmware backward.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-44018 CVE-2025-46404 CVE-2025-46705 CVE-2025-46784 CVE-2025-47151
Related: ⚡ Weekly Recap: USB Malware, React2Shell, WhatsApp Worms, AI IDE Bugs & More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026