CVE-2025-32748: Dell PowerFlex Manager Host Header Injection Vulnerability

Technical summary

This host header injection vulnerability (CWE-601) affects the request validation logic in Dell PowerFlex Manager. The application fails to properly validate or sanitize the Host header before using it in redirect responses or constructing URLs. An attacker can send a crafted HTTP request with a spoofed Host header pointing to an attacker-controlled domain. When the application reflects this value in a redirect (HTTP 301/302 response), the user's browser follows the redirect to the attacker's site. The vulnerability requires no authentication and has low attack complexity, though user interaction is necessary for exploitation to succeed.

Business impact

The primary risk is credential harvesting and social engineering attacks. An attacker could redirect users from legitimate PowerFlex Manager login pages to convincing phishing clones, capturing administrative credentials. Secondary impacts include brand reputation damage, as users may perceive Dell infrastructure as compromised. In security-conscious organizations, this could erode trust in PowerFlex infrastructure. The attack vector is network-based and requires no special privileges, making it accessible to external threat actors. However, the impact is limited to confidentiality in the CVSS model, and only when a user is successfully manipulated into following the redirect.

Affected systems

Dell PowerFlex Manager is affected in all versions prior to 5.1.0.1. Organizations should consult the Dell PowerFlex Rack Release Certification Matrix and verify their current deployment versions against this threshold. The vulnerability applies to PowerFlex Manager deployments accessible over a network, including those behind load balancers or reverse proxies if the Host header is not normalized upstream.

Exploitability

Exploitability is moderate. The attack requires no authentication and can be launched remotely by any network-adjacent actor. Attack complexity is low—an attacker simply crafts an HTTP request with a malicious Host header. However, the attack does require user interaction: the victim must receive a link to the vulnerable application with the injection payload and click it. This reduces the likelihood of large-scale automated exploitation. Phishing emails or social media campaigns would be the typical delivery mechanism. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Upgrade Dell PowerFlex Manager to version 5.1.0.1 or later. Dell has released a patched version that properly validates Host headers before using them in redirects. Organizations unable to upgrade immediately should implement compensating controls: restrict network access to PowerFlex Manager admin interfaces via firewall rules or VPN, deploy web application firewalls (WAF) configured to reject requests with suspicious Host headers, and educate users about verifying URLs before clicking links in communications referencing infrastructure systems.

Patch guidance

Dell has released PowerFlex Manager 5.1.0.1 with the fix for this vulnerability. Verify the version against the Dell PowerFlex Rack Release Certification Matrix before deployment. Test the patch in a non-production environment to ensure compatibility with your existing infrastructure. Update your inventory management systems and apply the patch according to your change management policy. For environments where immediate patching is not feasible, prioritize applying the update within 30 days given the moderate CVSS score and unauthenticated attack vector.

Detection guidance

Monitor HTTP logs for requests containing unexpected or duplicate Host headers, particularly those pointing to external domains. Look for patterns where the Host header differs from the expected internal FQDN of your PowerFlex Manager deployment. Web application firewalls and network IDS systems should flag requests where the Host header contains domains outside your organization's controlled namespaces. If PowerFlex Manager logs are available, inspect them for redirect responses generated by user-supplied input. Consider alerting on any 301/302 responses that redirect to external domains. Network flow monitoring can detect when users are redirected from PowerFlex Manager IPs to unexpected external destinations.

Why prioritize this

While the CVSS score of 4.3 (Medium) is not critical, this vulnerability warrants relatively prompt attention because it is unauthenticated, remotely exploitable, and fits into well-established social engineering and phishing attack chains. PowerFlex Manager is often accessed by infrastructure and storage administrators who manage business-critical systems; compromising their credentials poses significant downstream risk. The fact that it is not yet in the KEV catalog provides a brief window to patch before it potentially becomes a target of active campaigns. Prioritize patching over vulnerabilities requiring authentication or local access.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects an unauthenticated, remotely accessible vulnerability with low attack complexity, but limited impact (confidentiality only, via user interaction). The user interaction requirement prevents a higher rating. However, organizations should not under-weight this based on the numerical score alone: the combination of no authentication, network accessibility, and targeting of privileged user populations (storage admins) creates meaningful business risk that justifies rapid patching despite the 'Medium' severity label.

Frequently asked questions