CVE-2025-32748: Dell PowerFlex Host Header Injection Flaw

CVE-2025-32748 Overview

CVE-2025-32748 is a Host Header Injection vulnerability affecting Dell PowerFlex rack running Rack Consistency Management (RCM) version 3.7/3.7. The flaw, classified under [CWE-601] (URL Redirection to Untrusted Site), allows an unauthenticated remote attacker to manipulate the HTTP Host header to trigger arbitrary redirections. Successful exploitation requires user interaction, such as a victim clicking a crafted link.

The vulnerability impacts confidentiality at a low level and does not directly affect integrity or availability. Attackers typically leverage open redirect conditions to facilitate phishing campaigns, credential harvesting, and bypassing of URL filtering controls.

Critical Impact
An unauthenticated remote attacker can craft malicious requests that cause the PowerFlex rack management interface to redirect users to attacker-controlled domains, enabling phishing and credential theft.

Affected Products

Dell PowerFlex rack RCM 3.7
Dell PowerFlex rack management web interface
Deployments using the affected RCM release stream

Discovery Timeline

2026-06-17 - CVE-2025-32748 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32748

Vulnerability Analysis

The vulnerability resides in how Dell PowerFlex rack RCM 3.7 processes the HTTP Host header within incoming requests. The application trusts the client-supplied Host header value and reflects it in generated URLs, including redirect responses. When the server constructs absolute URLs using this attacker-controlled input, redirection targets can be steered to external domains.

Classified under [CWE-601], this Host Header Injection enables URL redirection to untrusted sites. The attack requires user interaction, meaning a victim must follow a crafted link or submit a tampered request. Once triggered, the response returned by the PowerFlex management interface points the browser to an attacker-defined destination.

While the vulnerability does not grant code execution or data modification, it undermines the trust boundary of the management console. Attackers use such flaws to stage phishing pages that mimic the legitimate PowerFlex login portal.

Root Cause

The root cause is improper validation of the Host header during URL construction. The application fails to compare the inbound header against an allowlist of trusted hostnames before incorporating it into Location response headers or password-reset style links.

Attack Vector

An attacker crafts an HTTP request to the PowerFlex rack management interface containing a malicious Host header value, such as Host: attacker.example.com. The attacker then distributes a link referencing the legitimate PowerFlex hostname but designed to traverse a request path that triggers a redirect. The victim's browser follows the response and lands on the attacker-controlled domain.

The vulnerability is exploitable in prose only; no verified public proof-of-concept code is available. Refer to the Dell Support Article for vendor-published technical context.

Detection Methods for CVE-2025-32748

Indicators of Compromise

HTTP requests to PowerFlex rack management endpoints containing Host header values that do not match the deployed hostname or management VIP
HTTP 302 or 301 responses with Location headers referencing external or unfamiliar domains
Phishing emails containing links to PowerFlex management URLs with embedded redirect parameters

Detection Strategies

Inspect web server access logs for mismatches between the configured server hostname and the Host header in client requests
Deploy web application firewall (WAF) rules that validate the Host header against an allowlist for the PowerFlex management interface
Correlate redirect responses originating from PowerFlex hosts with downstream DNS queries to non-corporate domains

Monitoring Recommendations

Forward PowerFlex management interface access logs to a centralized SIEM for Host header anomaly analysis
Alert on outbound HTTP redirects from PowerFlex management URLs pointing to domains outside the organization's trust zone
Track user click-through behavior from email security gateways to PowerFlex URLs with suspicious query strings

How to Mitigate CVE-2025-32748

Immediate Actions Required

Restrict network access to the PowerFlex rack RCM management interface to trusted administrative networks only
Educate administrators about phishing attempts referencing PowerFlex login URLs
Review the Dell Support Article for vendor-supplied guidance and apply available patches

Patch Information

Dell publishes remediation guidance through its support knowledge base. Administrators running PowerFlex rack RCM 3.7 should consult Dell's security advisories for the recommended upgrade path or hotfix that addresses the Host Header Injection condition. Apply vendor updates through standard change-management procedures.

Workarounds

Configure the upstream reverse proxy or load balancer to strip or normalize the Host header before forwarding requests to the PowerFlex management interface
Deploy WAF rules that drop requests where the Host header does not match the approved management FQDN
Disable or restrict any password-reset or email-notification features that embed user-controllable URLs until patching is complete

bash

# Example NGINX reverse proxy configuration enforcing Host header validation
server {
    listen 443 ssl;
    server_name powerflex-mgmt.example.com;

    if ($host !~* ^powerflex-mgmt\.example\.com$) {
        return 421;
    }

    location / {
        proxy_set_header Host powerflex-mgmt.example.com;
        proxy_pass https://powerflex-backend;
    }
}