by Kastro
Paper/Archive/CVE-2022-34442

CVE-2022-34442

Dell EMC Secure Connect Gateway (SCG) Policy Manager — Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability.

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 37.3.373 × 207.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability.  An attacker with the knowledge of the hard-coded sensitive information, could potentially exploit this vulnerability to login to the system to gain LDAP user privileges.

Affected

ProductAffectedFixed inSource
Secure Connect Gateway (SCG) Policy Manager5.10 – < 5.125.12CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
dell (CNA)8.0CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

advisorydell.com/support/kbdoc/en-us/000204995/dsa-2022-273-dell-secure-connect-gateway-policy-manager-security-update-for-multiple-proprietary-code-vulnerabilities