如何確認安裝 DSA-2025-053 中列出的已補救 ControlVault3 版本

目錄

• 使用裝置管理員確認 ControlVault3 版本
• 使用 PowerShell 指令檔確認 ControlVault3 版本

使用裝置管理員確認 ControlVault3 版本

查閱 ControlVault 驅動程式套件版本的最佳方式是在裝置管理員中尋找 ControlVault 版本。

1. 在命令前頭輸入 devmgmt.msc 在搜尋或執行列中，然後按 Enter 鍵
2. 尋找並展開 ControlVault 裝置，以滑鼠右鍵按一下 Dell ControlVault，選取 內容，移至 版本控制 標籤
   注意：裝置可能已列出沒有指紋觸控感應器的 ControlVault
3. 請確定您的韌體版本 為 5.15.7.0 （ControlVault3 ） 或 6.2.24.0 （ControlVault3+）
   
   
   

回到頁首

使用 PowerShell 指令檔確認 ControlVault3 版本

這些指示旨在運用以下 PowerShell 指令檔，直接在測試的電腦上執行。

1. 使用本文底部的文稿，創建一個名為以下內容的檔： Verify_ControlVault_dsa-2025-053_Standalone_V1.ps1
   1. 此指令檔：
      1. 檢查電腦上是否已安裝 Dell Control Vault 驅動程式，並將結果傳回給 $ControlVaultDriver
      2. 如果找到 Control Vault 驅動程式，請從 CVFirmwareUpgradeLog.txt 並將韌體 （FW） 修訂版與 DSA 針對 CV3 和 CV3+ 所需的韌體修訂版進行比較。如果需要，固件滿足，輸出到主控台
2. 開啟 PowerShell
   1. 按下 Windows 鍵 + R，輸入 PowerShell 並按 回車鍵
      或者，
   2. 在「開始」功能表中搜尋 PowerShell，然後選取
3. PowerShell 可能會封鎖指令檔，視您的電腦原則而定，您必須將此指令檔複製並貼到 PowerShell 中，然後按下 Enter 鍵，以暫時變更此限制：
   1. Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
4. 使用 cd 將目錄變更為儲存指令檔的位置，例如：
   1. cd “C:\Users\UserName\Documents\Scripts"
5. 將下列內容複製貼到 PowerShell，然後按下 Enter 鍵以執行指令檔：
   1. .\Verify_ControlVault_dsa-2025-053_Standalone_V1.ps1
6. 將傳回以下結果之一：
   • 應更新 ControlVault 韌體。
   • ControlVault 韌體最新 ，包括 DSA-2025-053 的緩解措施
   • 您的電腦沒有 ControlVault
   • 您的電腦必須重新開機
   • 如果指令檔無法解譯韌體版本，則發生錯誤

<#PSScriptInfo
.VERSION V1.0 - 8/14/2025
#>

<# 
.DESCRIPTION
	This script is intended to verify a Dell system against the vulnerabilities disclosed here https://www.dell.com/support/kbdoc/000276106/dsa-2025-053
	and is not intended to be supported/updated
	It is not intended to be used for keeping ControlVault firmware or drivers up-to-date
	Checks if Dell Control Vault Driver is installed on System and returns result to $ControlVaultDriver
	If Control Vault Driver is found, pull the last line from CVFirmwareUpgradeLog.txt and compare the FW revision to the 
	required FW revision from DSA for CV3 and CV3+.  If required firmware meet, output to console

.USEAGE
	This script, Verify_ControlVault_dsa-2025-053_Standalone_V1.ps1 is intended to be run directly on the system intended for testing.  
	Verify_ControlVault_dsa-2025-053_inTune_XX.ps1 still in development intended to be run for multiple device compliance reporting through Intune
	
	RETURNS: ControlVault firmware should be updated.
	RETURNS: Verification Success: ControlVault firmware includes mitigations for DSA-2025-053
	RETURNS: Verification Success: Your computer does not have ControlVault
	RETRUNS: ControlVault maybe updated but needs to complete firmware update validation, Please reboot computer
	RETRUNS: There appears to be an issue parsing the CVFirmwareUpgradeLog.txt; this is likely caused by the last entry of this log not containing the expected data
#>

# Static variables with firmware versions with remediation for ControlVault3 and ControlVault3+
$cv3_required_FWver = [Version]"5.15.7.0"
$cv3plus_required_FWver = [Version]"6.2.24.0"

# Static variables for messaging
$DSA_URL = "https://www.dell.com/support/kbdoc/000276106/dsa-2025-053"
$checkmark = [char]0x2705
$xmark = [char]0x2612
$CVoutofdate = "$xmark ControlVault firmware should be updated. Please refer to $DSA_URL"
$CVcompliant = "$checkmark Verification Success: ControlVault firmware includes mitigations for DSA-2025-053"
$CVnotfound = "Verification Success: Your computer does not have ControlVault"
$CVerror = "There appears to be an issue parsing the CVFirmwareUpgradeLog.txt; this is likely caused by the last entry of this log not containing the expected data"
$CVreboot = "ControlVault maybe updated but needs to complete firmware update validation, Please reboot computer"

# Checks if Dell Control Vault Driver is installed on System and returns result to $ControlVaultDriver
$controlVaultDriver = Get-WmiObject Win32_PnPSignedDriver | Where-Object { $_.DeviceName -like "*Control Vault*" }
$resultstatus = 3

# Find the last entry of the firmwareupgrade log and determine if the firmware version is greater than the firmware version required 
if ($ControlVaultDriver){
	$matchingLines = Get-Content "c:\Windows\System32\CVFirmwareUpgradeLog.txt" | Where-Object { $_ -match "Will not update ControlVault firmware from" -or $_ -match "Updating ControlVault firmware from" }
	$lastLine = $matchingLines | Select-Object -Last 1
	
	if ($lastLine -match "Updating ControlVault firmware from") {
		$resultstatus = 5
		Write-Host "$CVreboot"
	}
	else{
		if ($lastLine -match "Will not update ControlVault firmware from\s+(\d+\.\d+\.\d+\.\d+)") {
			$versionStr = $matches[1]
			$version = [Version]$versionStr
	 
			if (($version.Major -eq 5 -and $version -ge $cv3_required_FWver) -or
				($version.Major -eq 6 -and $version -ge $cv3plus_required_FWver)) {
				$resultstatus = 4
				Write-Host "$CVcompliant"
			}
			else{
				$resultstatus = 2
				Write-Host "$CVoutofdate"
			}
		}
		else{
			$resultstatus = 3
			Write-Host "$CVerror" 
		}
	}
}
else{
	$resultstatus = 1
	Write-Host "$CVnotfound"
}


# Create result object
$result = [PSCustomObject]@{
    ComputerName = $env:COMPUTERNAME
    Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    ControlVaultInstalled = $null -ne $controlVaultDriver
	Resultstatus = $resultstatus
    DriverDetails = if ($controlVaultDriver) {
        
		$controlVaultDriver | Select-Object DeviceName 
    } else {
        $null
    }
}

# Return as JSON
$result | ConvertTo-Json -Depth 3

回到頁首

另一個指令檔正在開發中，將透過 inTune 執行以符合多個裝置，一旦可用，本文便會更新這些詳細資料。

如需其他詳細資料，請參閱 DSA-2025-053 。