Dell PowerFlex Manager versions up to 4.6.2 insecurely store sensitive data, allowing a local attacker who does not need to authenticate to read protected information. This weakness means that anyone able to reach the PowerFlex Manager system locally, for example via a local console or unintended physical access, could gain unauthorized insight into credentials or other data stored by the manager. The vulnerability is categorized as CWE‑922 and presents a low exploitation severity per the CVSS of 4.0.

The affected products are Dell PowerFlex Manager, including the Appliance and Rack deployments, for all releases through 4.6.2. Any installation using a version equal to or older than 4.6.2 should be reviewed.

The CVSS score of 4 indicates a low severity; however the flaw opens a local, unauthenticated data‑exposure path. Because an attacker requires only local access, the potential impact is primarily the leakage of confidential information. Exploitation does not lead to code execution or denial of service and the EPSS score is not available, suggesting limited published evidence of exploitation. The vulnerability is not listed in CISA KEV, but organizations should still mitigate promptly to prevent data exposure.