High severity · published Mar 1, 2024
CVE-2024-24900
Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain an improper authorization vulnerability
7.3
CVSS
0.2%
EPSS
No
On KEV
Description
Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain an improper authorization vulnerability. An adjacent network low privileged attacker could potentially exploit this vulnerability, leading to unauthorized devices added to policies. Exploitation may lead to information disclosure and unauthorized access to the system.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
Secure Connect Gateway (SCG) Policy Manager · Dell
before 5.22.00.16 · source: vendor
PM
SC
Secure Connect Gateway Policy Manager · Dell
before 5.22.00.16 · source: CISA
Affected product
SC
Secure Connect Gateway (SCG) Policy Manager
Dell
More from Secure Connect Gateway (SCG) Policy Manager
9.8
CVE-2026-76779
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Excessive Authentication Attempts vulnerability
9.8
CVE-2026-73595
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Download of Code Without Integrity Check vulnerability
9.8
CVE-2024-37131
SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability
8.8
CVE-2026-78026
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key vulnerability
8.8
CVE-2026-78023
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key vulnerability