A deserialization of untrusted input vulnerability exists in the cvhDecapsulateCmd functionality of Dell ControlVault3 firmware versions prior to 5.15.10.14 and ControlVault3 Plus versions prior to 6.2.26.36. This flaw allows a specially crafted ControlVault response to a command to trigger arbitrary code execution. An attacker who compromises the ControlVault firmware can exploit this vulnerability by crafting malicious responses.