Improper Certificate Validation in Dell Secure Connect Gateway

Executive Summary

Dell Secure Connect Gateway (SCG) Policy Manager before versions 5.34.00.16 and 5.36 has an Improper Certificate Validation flaw. This allows an unauthenticated attacker within the same network to exploit the issue, potentially causing information disclosure, tampering with data, or bypassing security protections.

Useful 0 Not Useful 0

Impact Analysis

If you use Dell SCG Policy Manager versions prior to 5.34.00.16 or 5.36, an attacker on your local network could intercept sensitive data, alter communications, or disable security controls without needing credentials.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to information disclosure and tampering, which may violate GDPR's data protection requirements for confidentiality and integrity. For HIPAA, it risks unauthorized access to protected health information, potentially breaching security rules under the HIPAA Security Rule.

Useful 0 Not Useful 0

Mitigation Strategies

Update Dell Secure Connect Gateway (SCG) Policy Manager to version 5.34.00.16 or later, or version 5.36 or later, to address the Improper Certificate Validation vulnerability.

Useful 0 Not Useful 0