PT-2022-6358 · Dell Emc · Dell Emc Scg Policy Manager

Mal + 1 · Published 2022-11-10 · Updated 2023-01-25 · CVE-2022-34442

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell EMC SCG Policy Manager versions 5.10 through 5.12

Description The issue is related to the use of a hard-coded cryptographic key in the Policy Manager software of Dell Secure Connect Gateway (SCG). An attacker with knowledge of the hard-coded sensitive information could potentially exploit this to login to the system and gain LDAP user privileges.

Recommendations For versions 5.10 through 5.12, consider disabling access to sensitive areas of the system until a patch is available to prevent potential privilege escalation. As a temporary workaround, restrict access to the system to minimize the risk of exploitation until the issue is resolved. Avoid using the system for sensitive operations until the hard-coded cryptographic key vulnerability is fixed. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-321

CWE-798

Related Identifiers

BDU:2023-01020

CVE-2022-34442

Affected Products

Dell Emc Scg Policy Manager

References · 7

• https://bdu.fstec.ru/vul/2023-01020 · Security Note
• https://dell.com/support/kbdoc/en-us/000204995/dsa-2022-273-dell-secure-connect-gateway-policy-manager-security-update-for-multiple-proprietary-code-vulnerabilities · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34442 · Security Note
• https://osv.dev/vulnerability/CVE-2022-34442 · Vendor Advisory
• https://t.me/cvenotify/42261 · Telegram Post
• https://t.me/cibsecurity/56657 · Telegram Post
• https://vuldb.com/ru/?id.218899 · Note