« Volver al listado

CVE-2025-26483

Estado: AnalizadaAlta (8.2)—

Dell PowerFlex Manager, versions 4.6.2 and prior, contains an Open Redirect Vulnerability. An unauthenticated attacker could potentially exploit this vulnerability, leading to a targeted application user being redirected to arbitrary web URLs. The vulnerability could be leveraged by attackers to conduct phishing attacks that cause users to divulge sensitive information.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Open Redirect (CWE-601) con interacción de usuario (UI:R) y acceso remoto sin autenticación. Vector explícita phishing para obtener información sensible. T1189 (drive-by) es más preciso que T1203 para redirecciones maliciosas en web.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User TrainingRestrict Web-Based ContentSoftware ConfigurationUser Account ManagementAuditApplication Isolation and Sandboxing

Tecnologías afectadas (3)

Dell — Powerflex Appliance Intelligent CatalogDell — Powerflex ManagerDell — Powerflex Rack

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-26483",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-26483",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-22T17:21:55.066531Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security_alert@emc.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security_alert@emc.com",
      "affectedData": [
        {
          "vendor": "Dell",
          "product": "PowerFlex Manager (Appliance)",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "IC 48.378.00",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "IC 48.383.00",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Dell",
          "product": "PowerFlex Manager (Rack)",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "3.7.8.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "3.8.3.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Dell",
          "product": "PowerFlex Manager",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "4.6.2"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-05-22T14:16:24.027",
  "references": [
    {
      "url": "https://www.dell.com/support/kbdoc/en-us/000391392/dsa-2025-434-security-update-for-dell-powerflex-appliance-multiple-third-party-component-vulnerabilities",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security_alert@emc.com"
    },
    {
      "url": "https://www.dell.com/support/kbdoc/en-us/000391568/dsa-2025-435-security-update-for-dell-powerflex-rack-multiple-third-party-component-vulnerabilities",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security_alert@emc.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security_alert@emc.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Dell PowerFlex Manager, versions 4.6.2 and prior, contains an Open Redirect Vulnerability. An unauthenticated attacker could potentially exploit this vulnerability, leading to a targeted application user being redirected to arbitrary web URLs. The vulnerability could be leveraged by attackers to conduct phishing attacks that cause users to divulge sensitive information."
    },
    {
      "lang": "es",
      "value": "Dell PowerFlex Manager, versiones 4.6.2 y anteriores, contiene una vulnerabilidad de redirección abierta. Un atacante no autenticado podría potencialmente explotar esta vulnerabilidad, lo que llevaría a que un usuario de la aplicación objetivo fuera redirigido a URLs web arbitrarias. La vulnerabilidad podría ser aprovechada por atacantes para llevar a cabo ataques de phishing que hagan que los usuarios divulguen información sensible."
    }
  ],
  "lastModified": "2026-07-23T16:10:00.137",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dell:powerflex_appliance_intelligent_catalog:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "143A1FBC-E531-4D6B-A237-DABC054CFBCA",
              "versionEndExcluding": "48.383.00"
            },
            {
              "criteria": "cpe:2.3:a:dell:powerflex_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "47528FB6-351E-4A1D-BD55-DF859B74206D",
              "versionEndIncluding": "4.6.2"
            },
            {
              "criteria": "cpe:2.3:a:dell:powerflex_rack:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "86363090-931D-4D2E-8A1B-84ED844A3450",
              "versionEndExcluding": "3.7.8.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security_alert@emc.com"
}