Dell PowerFlex Manager up to version 4.6.2 is affected by an Incorrect Privilege Assignment flaw (CWE-266). A low‑privileged attacker with local access can exploit this vulnerability to elevate their privileges, potentially gaining unauthorized access to higher‑level functions and data. The CVSS score of 5.3 indicates a moderate severity, highlighting that the flaw can be abused if an attacker can reach a local management node.

The affected products are Dell PowerFlex Manager, Dell PowerFlex Manager (Appliance), and Dell PowerFlex Manager (Rack) running any version up to and including 4.6.2. Both appliance and rack deployments are impacted.

The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that widespread exploitation has not been confirmed. However, the local attack vector and the moderate CVSS score mean that an adversary who can get low‑privileged local access to a manager node could relatively easily raise their privileges. Organizations should assume the risk is moderate to high if local access is not tightly controlled.