Dell PowerFlex Manager CVE-2025-32750

Exploitation requires network reachability to the Dell PowerFlex Manager web interface (typically HTTPS on the management network) at version 4.6.2 or earlier, with no authentication, user interaction, or special configuration toggle needed per the CVSS vector AV:N/AC:L/PR:N/UI:N - directory listing is exposed in the default shipped configuration. The primary limiting factor is deployment topology: PowerFlex Manager is intended to live on an isolated management network, so practical exploitation is gated by whether an attacker can reach that network (insider, compromised jump host, misconfigured firewall, or accidental internet exposure). Severity is also bounded by what sensitive content actually resides in the listable directories - installations whose served directories contain only static UI assets face lower real impact than those exposing logs, backups, or configuration dumps.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N is internally consistent: network-reachable, low complexity, no auth, no user interaction, and a pure confidentiality impact rated High - appropriate for a directory listing that may expose configuration files, backups, or credentials. EPSS data was not provided in the input and the CVE is not listed in CISA KEV, so probability of exploitation cannot be quantitatively asserted. The C:H rating is somewhat optimistic for a generic directory listing flaw unless sensitive artifacts are actually reachable; absent a public PoC or technical write-up, real-world risk depends heavily on what files the listed directories contain and whether the management interface is exposed beyond a trusted management network - a configuration Dell explicitly discourages. Treat as a high-priority patch for any PowerFlex Manager whose web UI is reachable from untrusted networks, and as moderate priority for properly segmented deployments.

An attacker who can reach the PowerFlex Manager HTTPS interface - for example, after pivoting onto a flat management network or finding an internet-exposed instance - issues unauthenticated GET requests to predictable directory paths and receives auto-generated HTML index pages enumerating filenames. The attacker harvests configuration files, log fragments, backup artifacts, or installer payloads disclosed by the listing and uses them to map the environment or stage follow-on attacks against the storage fabric. No public exploit identified at time of analysis, but the attack requires only a web browser or curl.