ReVault! When your SoC turns against you… deep dive edition
Summary: Cisco Talos researchers reverse-engineered Dell's ControlVault3, a Broadcom 5820X-based security daughter board that stores passwords, biometric templates and security codes in firmware, after noticing most of its Windows services lack ASLR. They decrypted the application firmware using hardcoded keys found in the bcmsbiCitadelA0_1.otp file, then found that cv_close frees a session pointer supplied by the host, allowing a forged session to corrupt heap memory, reported as CVE-2025-25215.
Bottom line: The component holding your fingerprints and stored credentials runs firmware whose application image was decryptable with keys shipped in the setup bundle, and its session handling trusts a pointer the host hands it.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026