CVE-2025-46371: Dell PowerFlex Auth Bypass Vulnerability

CVE-2025-46371 Overview

CVE-2025-46371 affects Dell PowerFlex Manager versions 4.6.2 and earlier. The vulnerability stems from the use of a broken or risky cryptographic algorithm in the SSH component [CWE-327]. A low-privileged attacker with local access can exploit this weakness to bypass protection mechanisms within the affected systems.

The flaw impacts the confidentiality of integrity controls rather than directly exposing data. Dell published advisories DSA-2025-434 and DSA-2025-435 covering PowerFlex Appliance and PowerFlex Rack deployments.

Critical Impact
A local, low-privileged attacker can leverage weak SSH cryptography in Dell PowerFlex Manager to bypass protection mechanisms and compromise system integrity.

Affected Products

Dell PowerFlex Manager versions <=4.6.2
Dell PowerFlex Appliance Intelligent Catalog
Dell PowerFlex Rack

Discovery Timeline

2026-05-22 - CVE-2025-46371 published to NVD
2026-05-22 - Last updated in NVD database

Technical Details for CVE-2025-46371

Vulnerability Analysis

The vulnerability resides in the SSH implementation used by Dell PowerFlex Manager. The component relies on cryptographic algorithms classified as broken or risky [CWE-327]. These algorithms no longer provide the integrity guarantees expected from modern SSH deployments.

An attacker with low-level local access to the appliance can interact with the SSH service using weakened cryptographic primitives. The exploitation leads to a protection mechanism bypass impacting integrity. Confidentiality and availability remain unaffected based on the CVSS vector.

The issue spans the PowerFlex Manager, PowerFlex Appliance Intelligent Catalog, and PowerFlex Rack product lines because they share the same management code path. Dell addressed the flaw alongside multiple third-party component vulnerabilities in the same advisory cycle.

Root Cause

The root cause is the continued use of deprecated or weak cryptographic algorithms within the SSH service. Modern hardened SSH configurations remove legacy ciphers, MACs, and key exchange algorithms known to be susceptible to downgrade or cryptanalytic attacks. PowerFlex Manager retained one or more such algorithms, allowing an attacker positioned locally to coerce the SSH session into using the weaker primitive.

Attack Vector

Exploitation requires local access and low privileges on a system that can reach the PowerFlex Manager SSH service. No user interaction is required. The attacker leverages the weak cryptographic algorithm to bypass an integrity-related protection mechanism. The scope remains unchanged, and the result is a high integrity impact without confidentiality or availability consequences.

No public proof-of-concept exploit is available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.005% at the 0.261 percentile, indicating low predicted exploitation probability.

See the Dell Security Update DSA-2025-434 and Dell Security Update DSA-2025-435 for vendor-specific technical context.

Detection Methods for CVE-2025-46371

Indicators of Compromise

SSH session negotiations on PowerFlex Manager hosts that complete using deprecated ciphers, MACs, or key exchange algorithms.
Unexpected local logins or shell activity originating from low-privileged service accounts on PowerFlex Manager appliances.
Modifications to SSH daemon configuration files (/etc/ssh/sshd_config) outside of approved change windows.

Detection Strategies

Audit the SSH server configuration on every PowerFlex Manager node and compare the offered algorithms against a hardened baseline.
Run network scanners such as ssh-audit against management interfaces to enumerate supported ciphers, MACs, and KEX algorithms.
Correlate authentication logs from PowerFlex Manager with endpoint telemetry to identify low-privileged local accounts initiating SSH sessions.

Monitoring Recommendations

Forward /var/log/secure and sshd logs from PowerFlex Manager appliances to a centralized log platform for retention and analysis.
Alert on SSH negotiation events that select algorithms outside the approved cryptographic policy.
Track configuration drift on PowerFlex Manager nodes through file integrity monitoring focused on SSH configuration paths.

How to Mitigate CVE-2025-46371

Immediate Actions Required

Upgrade Dell PowerFlex Manager beyond version 4.6.2 using the fixed release identified in Dell DSA-2025-434 and DSA-2025-435.
Restrict local and management network access to PowerFlex Manager appliances to a small set of administrative hosts.
Review and rotate credentials for any low-privileged local accounts that have shell or SSH access to PowerFlex Manager.

Patch Information

Dell released fixes through advisories DSA-2025-434 for PowerFlex Appliance and DSA-2025-435 for PowerFlex Rack. Both advisories address multiple third-party component vulnerabilities, including the broken cryptographic algorithm condition tracked under CVE-2025-46371. Apply the vendor-provided update package corresponding to your deployment topology.

Workarounds

Harden the SSH daemon by explicitly disabling deprecated ciphers, MACs, and key exchange algorithms in sshd_config where supported by Dell guidance.
Place PowerFlex Manager management interfaces on an isolated administrative VLAN with strict access control lists.
Enforce multi-factor authentication and jump-host access for any administrative connection to PowerFlex Manager.

bash

# Example hardened SSH configuration in /etc/ssh/sshd_config
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
HostKeyAlgorithms ssh-ed25519,rsa-sha2-512,rsa-sha2-256

# Validate the running configuration
sshd -T | grep -Ei 'ciphers|macs|kexalgorithms'