EUVD-2025-209921
GHSA-w3w5-rfwv-898q
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information tampering.
AnalysisAI
Improper certificate validation in Dell PowerFlex Manager version 4.6.2 and earlier allows an unauthenticated attacker on an adjacent network to intercept and tamper with protected communications. The flaw (CWE-295) means the product fails to adequately verify peer certificates during TLS/SSL exchanges, enabling a man-in-the-middle position to read or modify in-transit management data. No active exploitation is confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Technical ContextAI
CWE-295 (Improper Certificate Validation) indicates Dell PowerFlex Manager does not properly authenticate the identity of communicating peers during TLS/SSL handshakes - typically manifesting as missing hostname verification, acceptance of untrusted or expired certificates, or skipped revocation checks. Both the Appliance (cpe:2.3:a:dell:powerflex_manager_(appliance):*:*:*:*:*:*:*:*) and Rack (cpe:2.3:a:dell:powerflex_manager_(rack):*:*:*:*:*:*:*:*) hardware form factors are affected, as is the generic PowerFlex Manager CPE. The product manages Dell PowerFlex hyperconverged infrastructure, making its management plane a sensitive communication channel. The CVSS vector AV:A restricts exploitation to adjacent network segments - the attacker must share a local network, subnet, or broadcast domain with the target.
RemediationAI
Upgrade Dell PowerFlex Manager beyond version 4.6.2 following guidance in Dell advisories DSA-2025-434 for Appliance deployments (https://www.dell.com/support/kbdoc/en-us/000391392) and DSA-2025-435 for Rack deployments (https://www.dell.com/support/kbdoc/en-us/000391568). The exact patched version number is not specified in available input data - consult the relevant Dell advisory directly to confirm the minimum safe version for your deployment form factor. Where immediate patching is not feasible, restrict access to the PowerFlex Manager management interface using VLAN segmentation or firewall ACLs to enforce strict adjacency controls, limiting the pool of hosts that can reach the management plane; note this reduces but does not eliminate risk for hosts already on the same segment. Additionally, monitoring for anomalous ARP activity or unexpected certificate presentations on management VLANs can serve as an early-warning compensating control.
More in Powerflex Manager
View allDell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.
Root-level OS command execution in Dell PowerFlex Manager (versions prior to 5.1.0.1) lets a remote, high-privileged att
SQL injection in Dell PowerFlex Manager prior to version 5.1.0.1 allows a remote, low-privileged authenticated attacker
Open redirect in Dell PowerFlex Manager versions 4.6.2 and prior lets an unauthenticated remote attacker craft a link th
Elevation of privilege in Dell PowerFlex Manager (versions <=4.6.2, including the Appliance and Rack variants) allows a
SQL injection in Dell PowerFlex Manager before 5.1.0.1 lets a low-privileged, remotely authenticated user inject crafted
Information disclosure in Dell PowerFlex Manager (Appliance, Rack, and core Manager) versions 4.6.2 and earlier allows u
Information exposure in Dell PowerFlex Manager (Appliance, Rack, and standalone) versions <=4.6.2 allows unauthenticated
Dell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.
Dell PowerFlex Manager, versions prior to 4.5.1.1, contain an improper certificate validation vulnerability. Rated mediu
Dell PowerFlex Manager versions 4.6.2 and earlier improperly store sensitive information in a manner accessible to low-p
Insecure storage of sensitive information in Dell PowerFlex Manager versions up to and including 4.6.2 exposes credentia
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today