EUVD-2025-209907
GHSA-7pfj-h559-r483
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (dell) · only source for this CVE.
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through Directory Listing vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.
AnalysisAI
Information disclosure in Dell PowerFlex Manager (Appliance, Rack, and core Manager) versions 4.6.2 and earlier allows unauthenticated remote attackers to enumerate server contents through exposed directory listings. The flaw carries a CVSS 7.5 (high) rating driven entirely by confidentiality impact and requires no privileges or user interaction, though no public exploit identified at time of analysis and the issue is not on CISA KEV.
Technical ContextAI
Dell PowerFlex Manager is the management plane for Dell's software-defined storage and hyperconverged infrastructure stack (PowerFlex Appliance and PowerFlex Rack), providing lifecycle management, provisioning, and monitoring of compute and storage nodes. The root cause is CWE-548 (Exposure of Information Through Directory Listing), typically caused by a web server or application server (Apache, nginx, or an embedded Java container) configured to auto-generate index pages when no default document is present in a served directory. Per Dell's DSA-2025-434 and DSA-2025-435, this issue is bundled with multiple third-party component vulnerabilities, suggesting the directory listing is exposed by an underlying packaged web component rather than custom Dell application code.
RemediationAI
Patch available per vendor advisory - upgrade Dell PowerFlex Manager to a release later than 4.6.2 as specified in Dell DSA-2025-434 (Appliance, https://www.dell.com/support/kbdoc/en-us/000391392) and DSA-2025-435 (Rack, https://www.dell.com/support/kbdoc/en-us/000391568); the exact fixed build is not enumerated in the input data and should be confirmed against the live advisory. Until the upgrade is applied, restrict network access to the PowerFlex Manager web interface so it is reachable only from a dedicated management VLAN or jump host, which is Dell's recommended deployment posture and prevents anonymous internet or general-LAN access; the trade-off is that any admin workflow currently relying on broader reachability (for example, browser access from a user subnet) will break and must be moved behind the jump host or VPN. If a web application firewall fronts the management UI, add a rule to block requests to URIs that end in '/' and return auto-generated index pages, accepting the side effect that legitimate directory-browsing features (if any) will also be blocked.
More in Powerflex Manager Appliance
View allOpen redirect in Dell PowerFlex Manager versions 4.6.2 and prior lets an unauthenticated remote attacker craft a link th
Elevation of privilege in Dell PowerFlex Manager (versions <=4.6.2, including the Appliance and Rack variants) allows a
Information exposure in Dell PowerFlex Manager (Appliance, Rack, and standalone) versions <=4.6.2 allows unauthenticated
Improper certificate validation in Dell PowerFlex Manager version 4.6.2 and earlier allows an unauthenticated attacker o
Dell PowerFlex Manager versions 4.6.2 and earlier improperly store sensitive information in a manner accessible to low-p
Insecure storage of sensitive information in Dell PowerFlex Manager versions up to and including 4.6.2 exposes credentia
Broken or risky cryptographic algorithm use in Dell PowerFlex Manager's SSH component (versions ≤4.6.2) allows a locally
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today