PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-46371 Dell CVE debrief

PatchSiren has analyzed CVE-2025-46371, a vulnerability in Dell PowerFlex Manager versions <= 4.6.2. The vulnerability is related to the use of a broken or risky cryptographic algorithm in SSH, potentially allowing a low-privileged attacker with local access to bypass protection mechanisms. This vulnerability has a CVSS score of 3.6, indicating a low severity. The vulnerability exists in the SSH component of Dell PowerFlex Manager. System administrators and security teams should be aware of this vulnerability and take appropriate action to mitigate potential risks.

Vendor
Dell
Product
PowerFlex Manager (Appliance)
CVSS
LOW 3.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-22
Original CVE updated
2026-07-23
Advisory published
2026-05-22
Advisory updated
2026-07-23

Who should care

System administrators and security teams responsible for Dell PowerFlex Manager and related systems should be aware of this vulnerability and take appropriate action to mitigate potential risks. This includes reviewing the official CVE record and NVD entry for accurate information, assessing affected systems, and applying vendor-provided patches or updates.

Technical summary

CVE-2025-46371 is a Use of a Broken or Risky Cryptographic Algorithm vulnerability in Dell PowerFlex Manager versions <= 4.6.2. The vulnerability exists in the SSH component and has a CVSS score of 3.6, indicating a low severity. A low-privileged attacker with local access could potentially exploit this vulnerability to bypass protection mechanisms. The vulnerability is related to the use of a broken or risky cryptographic algorithm in SSH.

Defensive priority

Low priority, as the vulnerability requires local access and has a low CVSS score.

Recommended defensive actions

  • Inventory and assess Dell PowerFlex Manager systems for version <= 4.6.2
  • Apply vendor-provided patches or updates to address the vulnerability
  • Monitor system logs for potential exploitation attempts
  • Consider implementing additional security controls, such as multi-factor authentication
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-05-22T15:16:25.743Z and last modified on 2026-07-23T16:10:00.137Z. The NVD entry is currently Analyzed. Vendor advisories are available for mitigation. A low-privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass. The vulnerability exists in the SSH component of Dell PowerFlex Manager versions <= 4.6.2. The CVSS score is 3.6, indicating a low severity. To verify, defenders should review the official CVE record and NVD entry for accurate information.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-46371 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-46371

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-46371 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-46371

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://www.dell.com/support/kbdoc/en-us/000391392/dsa-2025-434-security-update-for-dell-powerflex-appliance-multiple-third-party-component-vulnerabilities

    [email protected] - Vendor Advisory

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://www.dell.com/support/kbdoc/en-us/000391568/dsa-2025-435-security-update-for-dell-powerflex-rack-multiple-third-party-component-vulnerabilities

    [email protected] - Vendor Advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.