Dell PowerFlex Manager versions older than 4.5.1.1 allow an attacker to bypass TLS certificate validation, satisfying the conditions of improper certificate validation. The flaw can be exploited by an unauthenticated, remote adversary to intercept or alter communications, effectively enabling a man‑in‑the‑middle attack. This vulnerability is classified under CWE-295.

Dell PowerFlex Manager is affected in all releases prior to 4.5.1.1, regardless of deployment size or architecture. No further vendor or product granularity is available from the CNA data.

The likely attack vector is a remote, unauthenticated attacker capable of sending traffic that the Dell PowerFlex Manager accepts while bypassing certificate validation. Based on the description, it is inferred that the attacker can hijack communications or perform a man‑in‑the‑middle attack, especially if DNS cache poisoning is used to redirect traffic. The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. Because the flaw is exploitable remotely and does not require privileged access, it could be leveraged by an attacker in any network region that can reach the Manager interface, especially in conjunction with DNS cache poisoning to redirect traffic.