Dell PowerFlex Manager CVE-2025-32747

Exploitation requires the attacker to already have local, authenticated access to the PowerFlex Manager host with at least low-level privileges (CVSS AV:L, PR:L) - it cannot be triggered remotely or by an unauthenticated actor. The specific prerequisite is the presence of the Incorrect Privilege Assignment on the PowerFlex Manager management stack in versions <=4.6.2 (or the corresponding Appliance/Rack builds below IC 48.383.00 / 3.8.3.0). Limiting factors that reduce realistic risk: the mandatory pre-existing local foothold, no network-facing exposure, no automatable mass exploitation (SSVC Automatable: no), and no user interaction requirement means it is deterministic once local access is held. The exact product feature or account that is over-privileged is not disclosed in the available data.

The signals are internally consistent toward a real-but-not-urgent local privilege-escalation issue. The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields 7.8 (High): local attack vector, low complexity, and pre-existing low privileges are required, but the payoff is full C/I/A on the affected host. Real-world exploitation pressure is low - EPSS is 0.01% (2nd percentile), CISA SSVC reports Exploitation: none and Automatable: no with only Partial technical impact, and there is no KEV listing and no public exploit identified. Note two data tensions to verify with the vendor: (1) the SSVC 'partial' technical impact conflicts somewhat with the CVSS C:H/I:H/A:H 'total' profile; and (2) the tag set labels this 'Information Disclosure' while the description and CVSS describe an Elevation of Privileges outcome - treat the tag as a mislabel and rely on the description. Because AV:L requires an authenticated local foothold, this is a defense-in-depth / post-compromise concern rather than an internet-facing emergency.

An attacker who has already obtained a low-privileged local account or session on the PowerFlex Manager host - for example a limited operator login or a compromised low-tier service account - invokes the mis-assigned privileged resource to escalate to full administrative control of the management appliance. Because attack complexity is low and no user interaction is needed, the escalation is reliable once local access exists, though it is bounded by first needing that authenticated foothold; no public exploit code is currently identified.