Dell PowerFlex Manager is vulnerable to a classic SQL injection flaw because special characters in SQL commands are not properly neutralised. A low‑privileged attacker who can reach the manager from an adjacent network could insert malicious SQL statements, potentially allowing unauthorized data disclosure, modification or escalation of privileges.

Dell PowerFlex Manager. The CVE entry does not list specific version numbers, so the vulnerability likely affects all currently released versions of the manager.

The CVSS score of 5.7 indicates moderate severity, while the EPSS score of less than 1% reflects a very low probability of exploitation at present. The vulnerability is not mentioned in CISA’s KEV catalog, meaning no widespread exploitation is known. Attackers would need local network access to the management interface and only low‑level credentials to exploit the flaw.