The Dell Terraform Provider for Redfish contains an Improper Certificate Validation flaw in its HTTP transport component (CWE-295). Because TLS certificate verification is disabled without condition, an attacker can perform a man‑in‑the‑middle attack and capture all Redfish BMC traffic, including administrator credentials. This weakness can lead to full exposure of sensitive data and unauthorized control of the target hardware.

All Dell Terraform Provider for Redfish installations with versions prior to 1.6.2 are affected. The vulnerability applies to any installation of the provider that communicates with Redfish interfaces over HTTP/HTTPS when using the default transport settings.

The flaw is rated critical with a CVSS score of 9. The EPSS score is 0.00283 (< 1%), but the lack of authentication and the ability to intercept traffic make exploitation highly plausible in environments with remote network access to the provider. The vulnerability is not currently listed in CISA’s KEV catalog, but its impact warrants immediate attention.