Secure Connect Gateway CVE-2025-36592

Exploitation requires an attacker to deliver a crafted input/URL to the Dell SCG Policy Manager web interface AND requires a legitimate user to interact with it (UI:R in the CVSS vector) - a victim must load the malicious page or click the crafted link for the injected script to execute. While no authentication is needed to craft the attack (PR:N), the practical value depends on targeting a user who has an active Policy Manager session, and impact is confined to the victim's browser context (C:L/I:L, no server-side availability impact). The user-interaction requirement is the primary limiting factor: automated, interaction-free mass exploitation is not possible. Affected deployments are limited to Policy Manager versions 5.20 through 5.28.

This is a moderate-severity reflected/stored cross-site scripting flaw (CWE-79, CVSS 5.4) whose signals consistently point to a LOW real-world priority. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) confirms network reach and no privileges required, but crucially requires user interaction (UI:R) and yields only limited confidentiality and integrity impact with no availability impact - typical of client-side script injection rather than server compromise. EPSS reinforces low urgency at 0.21% (11th percentile), and the vulnerability is NOT in CISA KEV with no public exploit code identified, so there is no evidence of active or imminent exploitation. No SSVC decision data was provided in the input. The signals are mutually consistent - low EPSS, no KEV, no POC, medium CVSS, and a UI-dependent attack vector all align, with no contradictions to flag. Net assessment: a legitimate issue to patch in routine cycles, not an emergency; the 'unauthenticated remote' framing in the description is real but tempered by the mandatory user-interaction requirement and the client-side-only impact.

An attacker crafts a malicious URL or input targeting the SCG Policy Manager web interface and lures an authenticated operator into clicking it (UI:R). When the victim's browser renders the unsanitized input, attacker-controlled JavaScript executes in the context of the Policy Manager session, potentially stealing session tokens or performing actions as the victim. No public exploit code has been identified at time of analysis.