CVE-2024-47477 Overview
CVE-2024-47477 is an improper certificate validation vulnerability [CWE-295] affecting Dell PowerFlex Manager versions prior to 4.5.1.1. The flaw allows a remote unauthenticated attacker to intercept or manipulate traffic through a man-in-the-middle (MITM) position, particularly when combined with DNS cache poisoning. Successful exploitation can compromise the confidentiality and integrity of communications handled by PowerFlex Manager.
Critical Impact
A network-positioned attacker can intercept and modify PowerFlex Manager traffic, exposing sensitive management data and enabling tampering with administrative communications.
Affected Products
- Dell PowerFlex Manager versions prior to 4.5.1.1
Discovery Timeline
- 2026-06-17 - CVE-2024-47477 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-47477
Vulnerability Analysis
The vulnerability resides in how Dell PowerFlex Manager validates X.509 certificates presented by remote endpoints during Transport Layer Security (TLS) handshakes. PowerFlex Manager accepts certificates without enforcing complete validation checks, breaking the trust model that TLS depends on. An attacker who can intercept network traffic can present a fraudulent certificate that PowerFlex Manager treats as legitimate.
The weakness is classified as [CWE-295] Improper Certificate Validation. Exploitation does not require authentication or user interaction, and the attack is conducted over the network. The EPSS probability of exploitation is 0.124% as of 2026-06-18.
Root Cause
The root cause is missing or incomplete certificate verification logic within PowerFlex Manager. The product fails to fully verify the certificate chain, hostname binding, or trust anchor when establishing outbound or inbound TLS sessions. As a result, the application establishes encrypted sessions with endpoints that cannot prove their identity.
Attack Vector
An attacker must occupy a network path between PowerFlex Manager and a peer service. The advisory specifically pairs the flaw with DNS cache poisoning, which lets the attacker redirect PowerFlex Manager to an attacker-controlled host. The attacker then presents a self-signed or otherwise invalid certificate. Because PowerFlex Manager does not enforce strict validation, it negotiates TLS with the rogue endpoint, allowing the attacker to read or alter the data in transit.
No verified proof-of-concept exploit code is publicly available. See the Dell Security Update DSA-2026-066 for vendor technical details.
Detection Methods for CVE-2024-47477
Indicators of Compromise
- Unexpected TLS sessions from PowerFlex Manager to hosts outside the documented management network.
- Certificate fingerprints in PowerFlex Manager logs that do not match the organization's internal certificate authority (CA).
- DNS responses for PowerFlex Manager dependencies resolving to unusual or external IP addresses.
Detection Strategies
- Inspect TLS traffic originating from PowerFlex Manager hosts and flag connections that negotiate with untrusted or self-signed certificates.
- Compare DNS query responses observed by PowerFlex Manager against authoritative records to detect cache poisoning attempts.
- Audit PowerFlex Manager application and system logs for TLS handshake anomalies and repeated reconnection events.
Monitoring Recommendations
- Enable network detection and response (NDR) tooling on the management VLAN hosting PowerFlex Manager.
- Forward PowerFlex Manager logs, host DNS resolver logs, and TLS metadata to a centralized SIEM for correlation.
- Alert on changes to the trusted certificate store on PowerFlex Manager systems.
How to Mitigate CVE-2024-47477
Immediate Actions Required
- Upgrade Dell PowerFlex Manager to version 4.5.1.1 or later as directed by Dell.
- Restrict PowerFlex Manager network access to a dedicated management segment with strict egress filtering.
- Validate that all certificates trusted by PowerFlex Manager are issued by an authorized internal CA.
Patch Information
Dell has released a fix in PowerFlex Manager version 4.5.1.1. Detailed remediation guidance is available in the Dell Security Update DSA-2026-066 advisory. Apply the update following Dell's documented upgrade procedure.
Workarounds
- Place PowerFlex Manager behind a TLS-inspecting gateway that enforces strict certificate validation on its behalf.
- Use DNS Security Extensions (DNSSEC) and trusted internal resolvers to reduce DNS cache poisoning risk.
- Implement static host entries for critical PowerFlex Manager dependencies to bypass DNS resolution where feasible.
# Configuration example: restrict PowerFlex Manager egress and pin DNS resolvers
# Replace addresses with your environment's trusted values
iptables -A OUTPUT -o eth0 -p tcp --dport 443 -d 10.10.0.0/24 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 443 -j DROP
echo "nameserver 10.10.0.53" > /etc/resolv.conf
chattr +i /etc/resolv.conf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
