Dell PowerFlex Manager CVE-2025-46371

Local system or network access is required (AV:L), meaning the attacker must already hold a foothold on the PowerFlex Manager host or reside on the same local network segment as the SSH management interface - remote internet-based exploitation is not possible. A low-privileged account on the target system is required (PR:L per CVSS); unauthenticated exploitation is not possible. High attack complexity (AC:H) imposes additional preconditions, likely including the ability to intercept or influence the SSH session negotiation, such as by performing a man-in-the-middle attack on a shared local segment. Exploitation is limited to PowerFlex Manager versions 4.6.2 and below across all form factors. The unchanged scope (S:U) means a successful attacker cannot directly leverage this vulnerability to pivot into other systems beyond the PowerFlex Manager itself. Confidentiality and integrity impact are both rated low, limiting the practical value of exploitation to partial data exposure or session tampering rather than full system compromise.

Real-world risk is low, consistent with the CVSS base score of 3.6. The local attack vector (AV:L) is the most significant constraint - exploitation requires the attacker to already have a presence on the host or local network segment, ruling out remote internet-facing exploitation. High attack complexity (AC:H) further implies specific preconditions such as the ability to observe or intercept SSH sessions or influence cipher negotiation. Low privileges (PR:L) confirm unauthenticated exploitation is not possible per the CVSS vector. Impact is limited to partial confidentiality (C:L) and integrity (I:L) with no availability disruption and unchanged scope (S:U), meaning successful exploitation cannot directly propagate beyond the PowerFlex Manager boundary. No EPSS score was provided in the source intelligence - exploitation probability is inferred from CVSS signals only and is presumed low. The vulnerability is not listed in CISA KEV and no public proof-of-concept is known, aligning this with a patch-and-harden posture rather than an emergency response priority. Organizations with strict insider threat or privileged access controls will have naturally limited exposure.

A low-privileged user with a local account on a PowerFlex Manager system running version 4.6.2 or earlier positions themselves to intercept SSH session traffic on the local management network - for example, via ARP poisoning on a shared segment - and exploits the negotiated weak cryptographic algorithm to decrypt or manipulate session data, potentially bypassing integrity or confidentiality protections on SSH-based management communications. The high attack complexity (AC:H) means the attacker must successfully establish the interception position under specific timing or network conditions, making opportunistic exploitation unlikely. No public proof-of-concept exploit code is known to exist at time of analysis.