Executive brief
Dell PowerFlex Manager, a tool used to manage and automate software-defined storage infrastructure, contains a security flaw in how it assigns user permissions. A user who already has limited access to the system could exploit this to gain higher-level administrative privileges. This could allow an unauthorized individual to perform restricted actions or access sensitive management functions within the storage environment.
Technical details
Dell PowerFlex Manager (versions 4.6.2 and prior) is vulnerable to an incorrect privilege assignment (CWE-266). The flaw exists within the management software's authorization logic, where permissions are not strictly enforced or are incorrectly mapped to user roles. A local attacker with existing low-level credentials can exploit this vulnerability to gain elevated privileges on the system. Successful exploitation allows the attacker to perform actions beyond their intended authorization level, potentially compromising the integrity and confidentiality of the management platform. Dell has released security updates (DSA-2025-434 and DSA-2025-435) to address this issue in PowerFlex Appliance and Rack configurations.
Affected products
- Dell PowerFlex Manager <= 4.6.2
- Dell PowerFlex Rack < 3.7.8.0, < 3.8.3.0
- Dell PowerFlex Appliance Intelligent Catalog < 48.383.00
Timeline
- 2026-05-22: disclosed
- 2026-05-22: advisory
References
- https://www.dell.com/support/kbdoc/en-us/000391392/dsa-2025-434-security-update-for-dell-powerflex-appliance-multiple-third-party-component-vulnerabilities
- https://www.dell.com/support/kbdoc/en-us/000391568/dsa-2025-435-security-update-for-dell-powerflex-rack-multiple-third-party-component-vulnerabilities