PT-2022-6303 · Dell Emc · Dell Emc Scg Policy Manager

Mal · Published 2022-06-23 · Updated 2023-01-19 · CVE-2022-34440

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell EMC SCG Policy Manager versions 5.10 through 5.12

Description The issue is related to a Hard-coded Cryptographic Key. An attacker with knowledge of the hard-coded sensitive information could potentially exploit this to login to the system and gain admin privileges. This could allow the attacker to elevate their privileges.

Recommendations For versions 5.10 through 5.12, update to a version that does not contain the hard-coded cryptographic key to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-321

CWE-798

Related Identifiers

BDU:2023-00794

CVE-2022-34440

Affected Products

Dell Emc Scg Policy Manager

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-34440 · Security Note
• https://osv.dev/vulnerability/CVE-2022-34440 · Vendor Advisory
• https://dell.com/support/kbdoc/en-us/000204995/dsa-2022-273-dell-secure-connect-gateway-policy-manager-security-update-for-multiple-proprietary-code-vulnerabilities · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00794 · Security Note
• https://dell.com/support/kbdoc/de-de/000204995/dsa-2022-273-dell-secure-connect-gateway-policy-manager-security-update-for-multiple-proprietary-code-vulnerabilities · Note
• https://manualzz.com/doc/63377507/dell-virtual-edition-secure-connect-gateway-user-s-guide · Note
• https://t.me/cvenotify/42416 · Telegram Post