Dell PowerFlex Manager CVE-2025-26483

Exploitation requires a targeted PowerFlex Manager user to click an attacker-supplied link that references the legitimate application (UI:R in the CVSS vector), and the vulnerable redirect endpoint/parameter must be reachable on the network (AV:N, PR:N - no authentication of the attacker). The practical limiting factors are: the attacker cannot force the redirect without victim interaction; the target must have network access to a vulnerable PowerFlex Manager (versions 4.6.2 and prior / pre-fix builds); and real damage depends on a convincing follow-on phishing destination, so success hinges on social engineering rather than a purely technical trigger. There is no privilege or configuration prerequisite noted by Dell - the flaw appears present in default configurations of the affected versions.

The signals are consistent and point to a modest, phishing-oriented risk rather than a critical infrastructure threat. Dell's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, base 8.2) is network-reachable and unauthenticated but explicitly requires user interaction (UI:R); the score is elevated mainly by S:C and C:H, which for an open redirect reflect the downstream phishing/credential-theft consequence rather than a direct compromise of the PowerFlex server itself - the redirect does not, by itself, read data off the appliance. Corroborating intelligence tempers the raw score: EPSS is 0.04% (12th percentile), CISA SSVC rates Exploitation as 'none', Automatable 'no', and Technical Impact 'partial', and there is no KEV listing and no known POC. The main conflict to flag is that the C:H rating overstates confidentiality impact for a pure redirect - any data loss depends entirely on the success of a follow-on phishing page, so treat this as a targeted social-engineering aid, not a widespread automated exploitation risk.

An attacker crafts a URL pointing at the organization's legitimate PowerFlex Manager hostname but embedding a malicious redirect parameter, then emails it to a storage administrator as a routine 'action required' notice. The admin, seeing the trusted PowerFlex domain, clicks the link and is transparently redirected to an attacker-controlled clone of the login page, where entered credentials are captured. No exploit code is publicly known, and the network vector with low complexity is offset by the required user interaction.