Dell PowerFlex Manager versions up to 4.6.2 are vulnerable to an Exposure of Information Through Directory Listing flaw. The weakness allows an unauthenticated attacker with remote access to enumerate and read directory contents, potentially revealing sensitive configuration files, logs, or other data that should be protected. The underlying issue is a Permissions Misconfiguration (CWE‑276).

Affected systems are Dell PowerFlex Manager, including the appliance and rack deployments. Victim installations running version 4.6.2 or older are at risk; newer releases contain the fix.

The CVSS score of 5.3 indicates a moderate risk level. EPSS data is not available, but the vulnerability is accessible to anyone who can reach the PowerFlex Manager remotely without authentication, making exploitation likely in environments with inadequate network segmentation. The vulnerability is not currently listed in CISA’s Known Exploited Vulnerabilities catalog, though it remains a valid threat to information confidentiality.