Dell PowerFlex Manager EUVD-2025-209919

Exploitation requires only network access to the PowerFlex Manager management web interface with directory listing enabled on the server (the default/misconfigured state in affected versions <=4.6.2); no authentication, credentials, or user interaction is needed (AV:N/AC:L/PR:N/UI:N). The primary limiting factor is network reachability of the management console - in typical deployments this interface is placed on a restricted management network rather than the public internet, so realistic exposure hinges on whether the console is reachable by the attacker. Impact is confined to information disclosure (C:H/I:N/A:N); there is no code execution, data modification, or service disruption, and value to the attacker depends on which files are exposed under the indexed directories.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, score 7.5) reflects easy, unauthenticated, remote read access with confidentiality-only impact, which drives the High rating despite no integrity or availability effect. Counterbalancing signals argue for measured prioritization: EPSS is extremely low (0.02%, 4th percentile), CISA SSVC lists Exploitation as 'none' and Automatable as 'no' with only 'partial' technical impact, and no KEV listing or public POC exists. The CVSS rates confidentiality as High, but directory listing typically discloses file/path names rather than full sensitive data contents, so the real-world confidentiality impact may be lower than C:H suggests - the true value depends on what files are indexable in a given deployment. Overall this is a legitimate unauthenticated-exposure issue worth patching, but not an urgent, actively-exploited emergency; treat it as standard-cycle remediation weighted by internet exposure of the management interface.

An attacker who can reach the PowerFlex Manager web interface over the network sends a request to a directory path and receives an auto-generated index of its contents, enumerating filenames and directory structure without any login. Using the disclosed paths, the attacker maps the application layout and harvests names of configuration, log, or backup files to inform further targeting. Exploitation is low-complexity and requires no authentication or user interaction, but no public exploit code has been identified at time of analysis.