Dell PowerFlex Manager CVE-2025-32751

Exploitation requires an authenticated local OS session on the Dell PowerFlex Manager host with at least low-privilege access (PR:L per CVSS). The CVSS vector AV:L confirms there is no network-based exploitation path; the attacker must have direct or remote-shell access to the underlying system. No user interaction is required once local access is established (UI:N). Exploitation is limited to confidentiality impact only-no write or denial-of-service capability is described. Limiting factors include: the requirement for a valid local account on the management appliance (not merely network reachability), the unchanged scope (S:U, meaning the vulnerability cannot directly compromise systems beyond the PowerFlex Manager host itself), and the absence of any network attack vector. Organizations that strictly control local and SSH/console access to the PowerFlex Manager appliance substantially reduce their exposure.

The CVSS base score of 5.5 (Medium) reflects the local-only attack vector (AV:L) and low-privilege prerequisite (PR:L), which meaningfully constrain exploitability compared to network-accessible vulnerabilities. The Confidentiality impact is rated High (C:H) with no Integrity or Availability impact, indicating a pure information-disclosure outcome within an unchanged scope. No EPSS data was provided; without it, exploitation probability cannot be quantified, though the local-only vector and absence of KEV listing suggest low opportunistic exploitation risk. The 'Authentication Bypass' tag in the advisory metadata is noteworthy: while the primary defect is information disclosure, if the exposed data contains administrative credentials or API tokens, downstream access could extend well beyond the local system. This elevates the practical risk above what the 5.5 base score implies. No public exploit code or proof-of-concept has been identified at time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog, making this a medium-priority patch target for organizations with local-access threat models (insider risk, shared-admin environments, or compromised endpoints).

An attacker with a low-privileged local account on the PowerFlex Manager host-such as a service account, a compromised operator account, or an insider with limited OS access-reads sensitive information from an insecurely protected storage location (e.g., a world-readable configuration file or unencrypted credential store). If the exposed data includes administrative credentials or API tokens, the attacker escalates privileges or authenticates laterally to other infrastructure components managed by PowerFlex Manager. No public exploit code has been identified at time of analysis.