A directory listing vulnerability in Dell PowerFlex Manager permits unauthenticated remote attackers to access sensitive information, posing a significant information disclosure risk.

This is an exposure of information through directory listing (CWE-548), which is exploitable by an unauthenticated remote attacker via the network.

The vulnerability allows unauthorized parties to view sensitive file structures and potentially access configuration data, which could be leveraged to facilitate further attacks. With a CVSS score of 7.5 (High), this represents a significant risk to confidentiality, especially given the ease of exploitation over the network without requiring authentication.

Immediate Action: Update Dell PowerFlex Manager to the versions specified in the vendor security advisories (DSA-2025-435 and DSA-2025-434).

Proactive Monitoring: Audit web server access logs for unusual directory traversal patterns or unauthorized requests for directory listings.

Compensating Controls: Use a Web Application Firewall (WAF) to block requests that attempt to list directories or access restricted file paths.

Public Exploit Available: No (exploit_available: false)

Due to the unauthenticated nature of this vulnerability and its network-accessible vector, immediate patching is strongly recommended. Administrators should review the linked Dell security advisories to ensure all components are updated to the appropriate, non-vulnerable versions.