The vulnerability is an Exposure of Information Through Directory Listing that allows an unauthenticated attacker with remote access to view the contents of directories on the PowerFlex Manager system. The attack can leak configuration files, logs, or other sensitive data, resulting in a breach of confidentiality for all users who rely on the manager service.

Dell PowerFlex Manager, PowerFlex Manager (Appliance), and PowerFlex Manager (Rack) running version 4.6.2 or earlier are susceptible to this flaw.

A CVSS score of 7.5 indicates high severity. Because the vulnerability can be accessed remotely without authentication, the attack vector is likely a web or management interface. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the potential for information disclosure remains significant for affected installations.