CVE-2024-24906

CVE-2024-24906 is a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions of Dell Secure Connect Gateway (SCG) Policy Manager. A highly privileged attacker on an adjacent network can inject malicious HTML or JavaScript into the Policy page. When a victim user views this page, the malicious code executes in their browser, potentially leading to information disclosure, session theft, or client-side request forgery. This vulnerability has a CVSS score of 7.6 (HIGH), indicating significant impact (High Confidentiality and Integrity) with a relatively low attack complexity, but requires high privileges and user interaction. The EPSS score is very low, suggesting a minimal probability of exploitation in the wild. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are also absent, indicating a low level of public awareness or concern regarding this CVE.