How to Confirm Installation of a Remediated ControlVault3 Version listed in DSA-2025-228

These instructions are intended to be run directly on the computer being tested leveraging the PowerShell script below. This script: 

1. Using the script at the bottom of this article, create a file named: Verify_ControlVault_dsa-2025-228.ps1
   1. This script:
      1. Checks if Dell Control Vault Driver is installed on computer and returns result to $ControlVaultDriver
      2. If Control Vault Driver is found, pull the last line from CVFirmwareUpgradeLog.txt and compare the firmware (FW) revision to the required FW revision from DSA for CV3 and CV3+. If required firmware meet, output to console
2. Open PowerShell
   1. Press Windows Key + R, type PowerShell and press Enter
      Or,
   2. Search for PowerShell in the start menu and select it
3. PowerShell may block scripts depending on your computer’s policy, you must change this restriction temporarily by copying and pasting this script into PowerShell and pressing Enter:
   1. Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
4. Use cd to change the directory to where your script is saved, for example:
   1. cd “C:\Users\UserName\Documents\Scripts"
5. Copy and Paste the following into PowerShell and press Enter to run the script:
   1. .\Verify_ControlVault_dsa-2025-228.ps1
6. One of the following results will be returned:
   • ControlVault firmware should be updated.
   • Verification Success: ControlVault firmware includes mitigations for DSA-2025-228
   • Verification Success: Your computer does not have ControlVault
   • ControlVault maybe updated but needs to complete firmware update validation, Please reboot computer
   • There appears to be an issue parsing the CVFirmwareUpgradeLog.txt; this is likely caused by the last entry of this log not containing the expected data

<#PSScriptInfo
.VERSION V1 - 11/12/2025
#>

<# 
.DESCRIPTION
	This script is intended to verify a Dell system against the vulnerabilities disclosed here https://www.dell.com/support/kbdoc/000276106/dsa-2025-228
	and is not intended to be supported/updated
	It is not intended to be used for keeping ControlVault firmware or drivers up-to-date
	Checks if Dell Control Vault Driver is installed on System and returns result to $ControlVaultDriver
	If Control Vault Driver is found, pull the last line from CVFirmwareUpgradeLog.txt and compare the FW revision to the 
	required FW revision from DSA for CV3 and CV3+.  If required firmware meet, output to console

.USEAGE
	This script, Verify_ControlVault_dsa-2025-228_Standalone_RC01.ps1 is intended to be run directly on the system intended for testing.  
	
	
	RETURNS: ControlVault firmware should be updated.
	RETURNS: Verification Success: ControlVault firmware includes mitigations for DSA-2025-228
	RETURNS: Verification Success: Your computer does not have ControlVault
	RETRUNS: ControlVault maybe updated but needs to complete firmware update validation, Please reboot computer
	RETRUNS: There appears to be an issue parsing the CVFirmwareUpgradeLog.txt; this is likely caused by the last entry of this log not containing the expected data
#>

# Static variables with firmware versions with remediation for ControlVault3 and ControlVault3+
$cv3_required_FWver = [Version]"5.15.10.0"
$cv3plus_required_FWver = [Version]"6.2.30.0"

# Static variables for messaging
$DSA_URL = "https://www.dell.com/support/kbdoc/000276106/dsa-2025-228"
$checkmark = [char]0x2705
$xmark = [char]0x2612
$CVoutofdate = "$xmark ControlVault firmware should be updated. Please refer to $DSA_URL"
$CVcompliant = "$checkmark Verification Success: ControlVault firmware includes mitigations for DSA-2025-228"
$CVnotfound = "Verification Success: Your computer does not have ControlVault"
$CVerror = "There appears to be an issue parsing the CVFirmwareUpgradeLog.txt; this is likely caused by the last entry of this log not containing the expected data"
$CVreboot = "ControlVault maybe updated but needs to complete firmware update validation, Please reboot computer"

# Checks if Dell Control Vault Driver is installed on System and returns result to $ControlVaultDriver
$controlVaultDriver = Get-WmiObject Win32_PnPSignedDriver | Where-Object { $_.DeviceName -like "*Control Vault*" }
$resultstatus = 3

# Find the last entry of the firmwareupgrade log and determine if the firmware version is greater than the firmware version required 
if ($ControlVaultDriver){
	$matchingLines = Get-Content "c:\Windows\System32\CVFirmwareUpgradeLog.txt" | Where-Object { $_ -match "Will not update ControlVault firmware from" -or $_ -match "Updating ControlVault firmware from" }
	$lastLine = $matchingLines | Select-Object -Last 1
	
	if ($lastLine -match "Updating ControlVault firmware from") {
		$resultstatus = 5
		Write-Host "$CVreboot"
	}
	else{
		if ($lastLine -match "Will not update ControlVault firmware from\s+(\d+\.\d+\.\d+\.\d+)") {
			$versionStr = $matches[1]
			$version = [Version]$versionStr
	 
			if (($version.Major -eq 5 -and $version -ge $cv3_required_FWver) -or
				($version.Major -eq 6 -and $version -ge $cv3plus_required_FWver)) {
				$resultstatus = 4
				Write-Host "$CVcompliant"
			}
			else{
				$resultstatus = 2
				Write-Host "$CVoutofdate"
			}
		}
		else{
			$resultstatus = 3
			Write-Host "$CVerror" 
		}
	}
}
else{
	$resultstatus = 1
	Write-Host "$CVnotfound"
}


# Create result object
$result = [PSCustomObject]@{
    ComputerName = $env:COMPUTERNAME
    Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    ControlVaultInstalled = $null -ne $controlVaultDriver
	Resultstatus = $resultstatus
    DriverDetails = if ($controlVaultDriver) {
        
		$controlVaultDriver | Select-Object DeviceName 
    } else {
        $null
    }
}

# Return as JSON
$result | ConvertTo-Json -Depth 3

Back to Top

Reference DSA-2025-228 for additional details.