PatchSiren cyber security CVE debrief
CVE-2025-32749 Dell CVE debrief
Dell PowerFlex Manager versions less than or equal to 4.6.2 contain an Exposure of Information Through Directory Listing vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure. This vulnerability affects Dell PowerFlex Manager systems, particularly those with remote access, and defenders should assess exposure and prioritize updates to a version greater than 4.6.2. The CVE record and NVD entry provide details on the vulnerability, but do not specify versions or provide additional information on exploitation.
- Vendor
- Dell
- Product
- PowerFlex Manager (Appliance)
- CVSS
- MEDIUM 5.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-22
- Original CVE updated
- 2026-10-05
- Advisory published
- 2026-05-22
- Advisory updated
- 2026-10-05
Who should care
Defenders responsible for Dell PowerFlex Manager systems, particularly those with remote access, should assess exposure and prioritize updates.
Why it matters
Defenders should prioritize verifying and updating Dell PowerFlex Manager to a version greater than 4.6.2, and assess exposure for systems with remote access.
- Verify Dell PowerFlex Manager version and update to a version greater than 4.6.2 if necessary
- Assess exposure for systems with remote access
- Monitor for potential information exposure
Technical summary
Dell PowerFlex Manager versions less than or equal to 4.6.2 contain an Exposure of Information Through Directory Listing vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure.
Defensive priority
Defenders should prioritize verifying and updating Dell PowerFlex Manager to a version greater than 4.6.2, and assess exposure for systems with remote access.
Recommended defensive actions
- Verify Dell PowerFlex Manager version and update to a version greater than 4.6.2 if necessary
- Assess exposure for systems with remote access
- Monitor for potential information exposure
Evidence notes
The CVE record and NVD entry provide details on the vulnerability, but do not specify versions or provide additional information on exploitation. The information provided in the CVE record and NVD entry is limited, and defenders should verify the affected scope, severity, and vendor guidance. The vendor advisory provides additional information on the vulnerability and recommends updating to a version greater than 4.6.2. Defenders should review the supplied official advisory or CVE to
Sources and references
Verified primary and authoritative sources
-
CVE-2025-32749 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2025-32749
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2025-32749 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2025-32749
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://www.dell.com/support/kbdoc/en-us/000391392/dsa-2025-434-security-update-for-dell-powerflex-appliance-multiple-third-party-component-vulnerabilities
[email protected] - Vendor Advisory
-
Source reference
Unverified legacy reference
URL: https://www.dell.com/support/kbdoc/en-us/000391568/dsa-2025-435-security-update-for-dell-powerflex-rack-multiple-third-party-component-vulnerabilities
[email protected] - Vendor Advisory
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.