CVE-2025-46371 Dell CVE debrief

Who should care

Defenders responsible for Dell PowerFlex Manager deployments should assess exposure and prioritize verification and potential upgrades to prevent protection mechanism bypass through local access exploitation of the ssh vulnerability. This includes reviewing and implementing additional security measures, monitoring local access controls, and verifying affected scope and severity.

Why it matters

A low-privileged attacker with local access could potentially exploit the Use of a Broken or Risky Cryptographic Algorithm vulnerability in Dell PowerFlex Manager versions <= 4.6.2, leading to protection mechanism bypass. Defenders should prioritize verifying and upgrading to a non-affected version, monitoring local access controls, and implementing additional security measures.

• Verify and upgrade to a non-affected version of Dell PowerFlex Manager
• Monitor local access controls and user privileges
• Implement additional security measures to prevent protection mechanism bypass

Technical summary

The vulnerability exists in the ssh component of Dell PowerFlex Manager versions <= 4.6.2, allowing a low-privileged attacker with local access to potentially exploit the Use of a Broken or Risky Cryptographic Algorithm vulnerability, leading to protection mechanism bypass. This vulnerability has a CVSS score of 3.6 and is classified as LOW severity. The vulnerability affects the Dell PowerFlex Manager's ssh component, and defenders should prioritize verifying and upgrading to a non-affected version of Dell PowerFlex Manager.

Defensive priority

Defenders should prioritize verifying and upgrading to a non-affected version of Dell PowerFlex Manager, if available, and monitor local access controls.

Recommended defensive actions

• Verify and upgrade to a non-affected version of Dell PowerFlex Manager, if available
• Monitor local access controls and user privileges
• Review and implement additional security measures to prevent protection mechanism bypass
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 3.6 and severity of LOW. Vendor advisories are available for Dell PowerFlex Appliance and Rack. The vulnerability affects Dell PowerFlex Manager versions <= 4.6.2 and is related to the use of a broken or risky cryptographic algorithm in the ssh component. Defenders should verify and upgrade to a non-affected version, monitor local access controls, and implement additional security measures.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.