EUVD-2025-209922
GHSA-883q-9j5h-3x3g
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Network-reachable and unauthenticated but needs a victim click (UI:R); redirect crosses origins (S:C); impact is limited confidentiality via phishing, so C:L and I/A:N rather than Dell's C:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Dell PowerFlex Manager, versions 4.6.2 and prior, contains an Open Redirect Vulnerability. An unauthenticated attacker could potentially exploit this vulnerability, leading to a targeted application user being redirected to arbitrary web URLs. The vulnerability could be leveraged by attackers to conduct phishing attacks that cause users to divulge sensitive information.
AnalysisAI
Open redirect in Dell PowerFlex Manager versions 4.6.2 and prior lets an unauthenticated remote attacker craft a link that, once clicked by a targeted user, silently forwards them from the trusted PowerFlex Manager domain to an attacker-controlled URL. Because the redirect abuses the credibility of the management interface, it is primarily a phishing and credential-harvesting enabler rather than a direct server compromise. There is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%).
Technical ContextAI
PowerFlex Manager is the web-based management console for Dell's PowerFlex software-defined storage/HCI platform, shipped in both appliance and rack form factors. The flaw is a CWE-601 URL Redirection to Untrusted Site ('Open Redirect'), which occurs when the application accepts a user-supplied destination (typically a return/next/redirect parameter) and issues an HTTP redirect to it without validating that the target belongs to an allow-listed domain. The affected CPEs are cpe:2.3:a:dell:powerflex_manager, cpe:2.3:a:dell:powerflex_manager_(appliance), and cpe:2.3:a:dell:powerflex_manager_(rack), indicating all packaging variants of the console share the vulnerable redirect handling.
RemediationAI
Vendor-released patch: upgrade PowerFlex Manager to a fixed build - Appliance IC 48.378.00 or IC 48.383.00, or Rack 3.7.8.0 or 3.8.3.0 (any build superseding 4.6.2), following Dell DSA-2025-434 (Appliance, https://www.dell.com/support/kbdoc/en-us/000391392/) and DSA-2025-435 (Rack, https://www.dell.com/support/kbdoc/en-us/000391568/). Because exploitation requires a victim to click an attacker-crafted link, effective compensating controls until patching include restricting network access to the PowerFlex Manager web UI to a trusted management network or VPN (limiting who can be phished on the real hostname), enforcing an egress/URL-filtering policy that blocks navigation to untrusted external domains from admin workstations, and briefing administrators to inspect the full URL of PowerFlex links before clicking; note these controls reduce but do not eliminate the redirect, since a valid internal user with legitimate access can still be lured, so upgrading remains the durable fix.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today