EUVD-2025-209922
GHSA-883q-9j5h-3x3g
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionNVD
Dell PowerFlex Manager, versions 4.6.2 and prior, contains an Open Redirect Vulnerability. An unauthenticated attacker could potentially exploit this vulnerability, leading to a targeted application user being redirected to arbitrary web URLs. The vulnerability could be leveraged by attackers to conduct phishing attacks that cause users to divulge sensitive information.
AnalysisAI
Open redirect vulnerability in Dell PowerFlex Manager 4.6.2 and prior enables unauthenticated remote attackers to craft malicious application URLs that silently redirect targeted users to arbitrary attacker-controlled web destinations. Exploitation requires user interaction (CVSS UI:R) - a victim must follow a specially crafted link - but no authentication or special privileges are needed on the attacker's side. The primary risk is phishing: because the initial URL appears to point at a legitimate Dell infrastructure management portal, users are more likely to trust and follow it, making credential theft or sensitive data disclosure against PowerFlex administrators a realistic outcome. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Technical ContextAI
CWE-601 (URL Redirection to Untrusted Site / Open Redirect) describes a failure to validate or sanitize attacker-supplied redirect destination parameters before issuing an HTTP redirect response. The CVSS Changed Scope (S:C) component accurately reflects the nature of this class of flaw: while the vulnerable code resides within the PowerFlex Manager web application, the impact extends to the victim's browser session and any site the attacker chooses to target. The attack vector is Network (AV:N) with Low complexity (AC:L), meaning no special network positioning or precondition is required. Dell PowerFlex Manager is a centralized management platform for Dell PowerFlex hyper-converged infrastructure, available in both Appliance and Rack deployment form factors - both are confirmed affected per CPE strings cpe:2.3:a:dell:powerflex_manager_(appliance):*:*:*:*:*:*:*:* and cpe:2.3:a:dell:powerflex_manager_(rack):*:*:*:*:*:*:*:*. The affected parameter is part of the publicly reachable web interface, requiring no authenticated session to construct a redirect chain.
RemediationAI
Apply the security updates published by Dell for the relevant deployment form factor: DSA-2025-434 for PowerFlex Manager Appliance (https://www.dell.com/support/kbdoc/en-us/000391392/dsa-2025-434-security-update-for-dell-powerflex-appliance-multiple-third-party-component-vulnerabilities) and DSA-2025-435 for PowerFlex Manager Rack (https://www.dell.com/support/kbdoc/en-us/000391568/dsa-2025-435-security-update-for-dell-powerflex-rack-multiple-third-party-component-vulnerabilities). No exact patched version number is specified in available intelligence - consult the linked advisories directly to confirm the minimum safe release. As compensating controls prior to patching, restrict access to the PowerFlex Manager web interface to trusted internal networks or VPN-only access, reducing exposure of the redirect endpoint to external attackers. Additionally, deploy email filtering and user awareness guidance specifically targeting PowerFlex administrators, cautioning against following PowerFlex Manager URLs received via unsolicited email or messaging. Web proxy policies that flag or block redirects from the PowerFlex Manager domain to untrusted external domains can provide a defensive layer, though this may require custom policy rules and could interfere with legitimate external redirect flows if any exist.
More from same product – last 7 days
Dell PowerFlex Manager versions 4.6.2 and earlier improperly store sensitive information in a manner accessible to low-p
Incorrect Privilege Assignment in Dell PowerFlex Manager version 4.6.2 and earlier (both Appliance and Rack form factors
Directory listing exposure in Dell PowerFlex Manager versions 4.6.2 and earlier allows an attacker to enumerate director
Improper certificate validation in Dell PowerFlex Manager version 4.6.2 and earlier allows an unauthenticated attacker o
Insecure storage of sensitive information in Dell PowerFlex Manager versions up to and including 4.6.2 exposes credentia
Share
External POC / Exploit Code
Leaving vuln.today