What is the CVSS score of CVE-2025-32749?

CVE-2025-32749 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Dell PowerFlex Manager are affected by CVE-2025-32749?

Dell PowerFlex Manager versions 4.6.2 and earlier contain an unauthenticated information disclosure vulnerability that exposes sensitive file paths and configuration details to remote attackers.. A patch is available.

How to fix or mitigate CVE-2025-32749?

Within 24 hours, identify all Dell PowerFlex Manager instances (appliance, rack, and standalone) running version 4.6.2 or earlier and implement network-level access restrictions to management interfaces where feasible. Within 7 days, deploy the vendor-released patch (version >4.6.2) to all affected systems and validate successful deployment. Within 30 days, review access logs for directory enumeration attempts, conduct a configuration audit of any exposed system details, and assess whether unauthorized reconnaissance occurred.

Dell PowerFlex Manager CVE-2025-32749

EUVD-2025-209919 HIGH

Incorrect Default Permissions (CWE-276)

2026-05-22 dell

GHSA-xprc-xvh6-w68r

Dell Information Disclosure Privilege Escalation Powerflex Manager Appliance Powerflex Manager Rack Powerflex Manager

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

Unauthenticated remote directory listing is low-complexity (AV:N/AC:L/PR:N/UI:N); confidentiality assessed C:L as it typically discloses filenames/paths rather than full sensitive contents, with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 23, 2026 - 16:41 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 23, 2026 - 16:22 vuln.today

cvss_changed

Severity Changed

Jul 23, 2026 - 16:22 NVD

MEDIUM HIGH

CVSS changed

Jul 23, 2026 - 16:22 NVD

5.3 (MEDIUM) 7.5 (HIGH)

Patch available

May 26, 2026 - 14:16 EUVD

Analysis Generated

May 22, 2026 - 14:03 vuln.today

DescriptionNVD

Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through Directory Listing vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.

AnalysisAI

Information exposure in Dell PowerFlex Manager (Appliance, Rack, and standalone) versions <=4.6.2 allows unauthenticated remote attackers to read directory listings served by the management interface, exposing file and path names that can reveal sensitive configuration and system details. The flaw is remotely reachable without credentials or user interaction (CVSS 7.5), but there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at just 0.02%. CISA's SSVC framework rates exploitation as 'none' and technical impact as 'partial,' indicating a genuine but non-critical disclosure issue rather than a code-execution threat.

Technical ContextAI

Dell PowerFlex Manager is the centralized management console for Dell's PowerFlex software-defined storage platform, deployed as an appliance, in rack-integrated form, and as a standalone manager. The vulnerability stems from directory listing being enabled on the web server component, so that requests to directory paths return an index of their contents instead of a forbidden or default response. Although the record tags this as CWE-276 (Incorrect Default Permissions), the description characterizes it as Exposure of Information Through Directory Listing (conceptually CWE-548) - the root cause is a misconfigured/default web server permission that leaves directory indexing active, letting an unauthenticated client enumerate filenames and paths that should not be publicly browsable. The affected CPEs cover cpe:2.3:a:dell:powerflex_manager_(appliance), cpe:2.3:a:dell:powerflex_manager_(rack), and cpe:2.3:a:dell:powerflex_manager.

RemediationAI

Patch available per vendor advisory: upgrade PowerFlex Manager (Rack) to 3.7.8.0 / 3.8.3.0 or later, PowerFlex Manager (Appliance) to IC 48.378.00 / IC 48.383.00 or later, and standalone PowerFlex Manager to a release above 4.6.2, following Dell DSA-2025-435 (Rack, https://www.dell.com/support/kbdoc/en-us/000391568/) and DSA-2025-434 (Appliance, https://www.dell.com/support/kbdoc/en-us/000391392/). Until patching completes, restrict network reachability of the PowerFlex Manager web interface to a dedicated management VLAN or jump host and block untrusted/internet access to its HTTP(S) ports, which reduces exposure but requires administrators to reach the console from approved networks only. If the underlying web server configuration is administrator-accessible, disabling directory indexing (autoindex/directory listing) on the management web root is a targeted mitigation, though this should only be done in coordination with Dell support to avoid affecting appliance-managed configuration and support processes.