Secure Connect Gateway CVE-2025-46363

Exploitation requires that the internal collection download REST API be explicitly enabled by an Admin user via the UI - this is NOT a default configuration, which substantially limits exposure. The attacker must also already possess a low-privileged authenticated account with remote access to the appliance (CVSS PR:L), so pre-existing access is a hard prerequisite. Affected deployments are limited to Dell Secure Connect Gateway 5.0 Application and Appliance versions 5.26.00.00 through 5.30.00.00. Impact is confined to reading restricted resources (confidentiality-only, C:L); there is no integrity or availability impact and no unauthenticated path.

This is a low-to-moderate priority issue despite being network-reachable. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3 Medium) describes a remote, low-complexity attack but one that requires existing low-level privileges (PR:L) and yields only limited confidentiality impact (C:L) with no integrity or availability effect. Critically, exploitation is gated behind a non-default condition: the internal collection download REST API must first be explicitly enabled by an Admin from the UI, which sharply narrows the realistic attack surface. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no signal of active or likely exploitation - this reads as a defense-in-depth file-read/path-traversal issue rather than an urgent threat. No conflicting signals were observed: the description's mention of 'low privileged attacker with remote access' is consistent with the PR:L/AV:N vector. Missing data to note: EPSS probability, KEV status, and POC availability are all absent from the input and cannot be assumed either way.

An attacker who already holds a low-privileged authenticated account on a Dell Secure Connect Gateway appliance (versions 5.26.00.00-5.30.00.00) where the internal collection download REST API has been enabled sends crafted relative path sequences to that endpoint to read restricted files outside the intended directory. No public exploit code is identified at time of analysis, and the attack is only possible if an administrator has turned the optional REST API on.