PT-2024-20654 · Dell · Dell Secure Connect Gateway (Scg) Policy Manager

Kosmosec · Published 2024-03-01 · Updated 2025-05-20 · CVE-2024-24903

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell Secure Connect Gateway (SCG) Policy Manager version 5.10+

Description The issue is related to a weak password recovery mechanism for forgotten passwords. An adjacent network low privileged attacker could potentially exploit this, leading to unauthorized access to the application with privileges of the compromised account. The attacker could retrieve the reset password token without authorization and then perform the password change.

Recommendations For version 5.10+, consider disabling the password recovery mechanism until a patch is available to prevent exploitation. Restrict access to the password reset functionality to minimize the risk of unauthorized password changes. Avoid using the password recovery feature in the affected version until the issue is resolved.

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2024-24903

Affected Products

Dell Secure Connect Gateway (Scg) Policy Manager

References · 6

• https://osv.dev/vulnerability/CVE-2024-24903 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24903 · Security Note
• https://dell.com/support/kbdoc/en-us/000222330/dsa-2024-077-security-update-for-dell-secure-connect-gateway-policy-manager-vulnerabilities · Vendor Advisory
• https://t.me/cvenotify/72787 · Telegram Post
• https://twitter.com/cracbot/status/1764024184647102698 · Twitter Post
• https://t.me/cvenotify/123110 · Telegram Post