CVE-2025-32749 Overview
CVE-2025-32749 affects Dell PowerFlex Manager versions 4.6.2 and earlier. The vulnerability stems from an Exposure of Information Through Directory Listing weakness [CWE-276]. An unauthenticated remote attacker can exploit the flaw to enumerate directory contents and access information that should remain protected.
Dell published advisories DSA-2025-434 and DSA-2025-435 to address the issue across PowerFlex Appliance, PowerFlex Manager, and PowerFlex Rack deployments. The vulnerability requires no privileges and no user interaction, making remote enumeration straightforward against exposed management interfaces.
Critical Impact
Unauthenticated remote attackers can enumerate directory contents on affected Dell PowerFlex Manager deployments, exposing configuration data and sensitive files that aid further attacks.
Affected Products
- Dell PowerFlex Manager (versions ≤4.6.2)
- Dell PowerFlex Appliance Intelligent Catalog
- Dell PowerFlex Rack
Discovery Timeline
- 2026-05-22 - CVE-2025-32749 published to NVD
- 2026-05-22 - Last updated in NVD database
Technical Details for CVE-2025-32749
Vulnerability Analysis
The vulnerability resides in the web-facing management component of Dell PowerFlex Manager. The component returns directory listings to unauthenticated HTTP requests instead of enforcing access controls. Attackers can browse exposed directories to identify file names, paths, and configuration artifacts within the management interface.
Directory listing exposure provides reconnaissance value to attackers. Disclosed file names reveal software components, version identifiers, backup locations, and log paths. This information shortens the path to follow-on exploitation against PowerFlex storage infrastructure.
Root Cause
The root cause is improper default permissions [CWE-276] on the PowerFlex Manager web interface. The server configuration permits directory enumeration on paths that should reject anonymous listing requests. Authentication and authorization checks are not applied before the listing response is generated.
Attack Vector
The attack vector is network-based and requires no authentication. An attacker sends HTTP requests to the PowerFlex Manager interface and receives directory contents in the response. The vulnerability affects confidentiality only, with no direct impact to integrity or availability.
The vulnerability is exploited without code execution or memory corruption. See the Dell Security Update DSA-2025-434 and Dell Security Update DSA-2025-435 for vendor-specific technical context.
Detection Methods for CVE-2025-32749
Indicators of Compromise
- HTTP responses from PowerFlex Manager containing directory listing HTML markup such as Index of / headers returned to unauthenticated clients.
- Anomalous enumeration patterns where a single source requests many directory paths in sequence against the PowerFlex management interface.
- Outbound transfers of configuration files, catalogs, or logs from PowerFlex hosts to untrusted destinations following directory probes.
Detection Strategies
- Inspect web server access logs on PowerFlex Manager for GET requests to directory paths without trailing resource names, especially from external IP addresses.
- Deploy network detection rules that flag HTTP responses containing directory index keywords originating from PowerFlex management endpoints.
- Correlate reconnaissance behavior across web, firewall, and identity logs to identify pre-attack enumeration campaigns targeting storage infrastructure.
Monitoring Recommendations
- Continuously monitor authentication-bypassed access to PowerFlex Manager URLs and alert on directory-style responses.
- Track baseline request patterns to the PowerFlex web interface and alert on deviations indicative of scanning.
- Review egress traffic from PowerFlex hosts for unusual file transfers that may indicate data exfiltration after enumeration.
How to Mitigate CVE-2025-32749
Immediate Actions Required
- Apply the updates referenced in Dell DSA-2025-434 and DSA-2025-435 to all PowerFlex Manager, PowerFlex Appliance, and PowerFlex Rack systems running version 4.6.2 or earlier.
- Restrict network access to the PowerFlex Manager web interface to trusted management networks using firewall and segmentation controls.
- Audit web server logs for prior unauthenticated directory listing requests to determine whether reconnaissance has already occurred.
Patch Information
Dell has released fixed versions through the advisories DSA-2025-434 and DSA-2025-435. Upgrade PowerFlex Manager to a version above 4.6.2 as specified in the vendor guidance.
Workarounds
- Place PowerFlex Manager behind a reverse proxy or web application firewall configured to block directory listing responses.
- Disable directory listing at the underlying web server configuration where supported, until the official patch is applied.
- Limit administrative access to PowerFlex management interfaces through VPN or jump host enforcement to reduce exposure.
# Configuration example - restrict access at the network layer
iptables -A INPUT -p tcp --dport 443 -s <trusted-mgmt-subnet>/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
