Vulnerability · Published Mar 1, 2024 · Assigned by dell

CVE-2024-22457

High 7.1

In plain English

A high-severity authentication bypass by spoofing in Secure Connect Gateway (SCG) 5.0 Appliance - SRS from Dell. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.3%top 78.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Dell Secure Connect Gateway 5.20 contains an improper authentication vulnerability during the SRS to SCG update path. A remote low privileged attacker could potentially exploit this vulnerability, leading to impersonation of the server through presenting a fake self-signed certificate and communicating with the remote server.

Affected products (as reported)

Vendor	Product	Versions
Dell	Secure Connect Gateway (SCG) 5.0 Appliance - SRS	5.20.00.10

Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

References

https://www.dell.com/support/kbdoc/en-us/000222433/dsa-2024-076-security-update-for-dell-secure-connect-gateway-appliance-vulnerabilities vendor-advisory