Medium severity · published Mar 1, 2024
CVE-2024-22458
Dell Secure Connect Gateway, 5.18, contains an Inadequate Encryption Strength Vulnerability
5.3
CVSS
0.1%
EPSS
No
On KEV
Description
Dell Secure Connect Gateway, 5.18, contains an Inadequate Encryption Strength Vulnerability. An unauthenticated network attacker could potentially exploit this vulnerability, allowing an attacker to recover plaintext from a block of ciphertext.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
Secure Connect Gateway (SCG) 5.0 Appliance - SRS · Dell
5.20.00.10 · source: vendor
SC
Secure Connect Gateway · Dell
5.18.00.20; 5.20.00.10 · source: NVD
Affected product
SC
Secure Connect Gateway (SCG) 5.0 Appliance - SRS
Dell
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-22458
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-22458
Patch
https://www.dell.com/support/kbdoc/en-us/000222433/dsa-2024-076-security-update-for-dell-secure-connect-gateway-appliance-vulnerabilities
More from Secure Connect Gateway (SCG) 5.0 Appliance - SRS
8.8
CVE-2024-48016
Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.24, contains a Use of a Broken or Risky Cryptographic Algorithm vulnerability
8.8
CVE-2024-22457
Dell Secure Connect Gateway 5.20 contains an improper authentication vulnerability during the SRS to SCG update path
8.1
CVE-2024-47241
Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.24, contains an Improper Certificate Validation vulnerability
6.3
CVE-2024-47240
Dell Secure Connect Gateway (SCG) 5.24 contains an Incorrect Default Permissions vulnerability
5.8
CVE-2025-23382
Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.26, contain(s) an Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability