EUVD-2026-85328
GHSA-fh3p-hc6v-5v65
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost malicious page framing SCG UI
-
ExploitLure authenticated operator to click
-
ExecutionOverlay hijacks framed UI actions
-
ImpactSteal session / escalate privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security Clickjacking prevention, X-Frame-Options
|
| Exploitation Conditions | Exploitation targets the SCG Policy Manager web UI's lack of anti-framing protections (missing X-Frame-Options or CSP frame-ancestors), allowing the interface to be embedded in an attacker-controlled page. Practically, an authenticated low-privileged user (PR:L) must be lured to the attacker's framing page while holding a valid session, and - despite Dell's UI:N rating - CWE-1021 UI redressing realistically requires that victim to click on the overlaid framed content, which materially limits real-world exploitation. Fixed in version 5.34.00.16. |
| Impact | This is a moderate-severity, low-real-priority issue. The Dell-provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N = 5.4) describes a network-reachable flaw requiring low privileges with only Low confidentiality and integrity impact and no availability impact. There is no EPSS score, no CISA KEV listing, and no public POC in the supplied data, so the signal set points to no confirmed exploitation. A key inconsistency: the CWE is CWE-1021 (Improper Restriction of Rendered UI Layers or Frames - clickjacking/UI redressing), a class that inherently depends on tricking a victim into interacting with a framed page, yet Dell rated it UI:N (no user interaction). This is contradictory - UI redressing realistically requires victim interaction (UI:R), which would lower the score and further reduce practical risk. The 'Elevation of privileges and Session theft' outcome is plausible for a framing attack but is bounded by C:L/I:L rather than full account takeover. Net: a real-but-low-priority hardening defect (missing frame-busting / X-Frame-Options / CSP frame-ancestors), not an urgent remotely-weaponizable bug. |
| Exploit ScenarioDerived | An attacker hosts a malicious page that frames the Dell SCG Policy Manager UI with transparent overlays, then lures an authenticated low-privileged operator into clicking, causing unintended privileged actions or exposure of session material. Because CWE-1021 framing depends on victim interaction, success requires social-engineering the target into visiting the attacker page while logged in. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Dell Secure Connect Gateway (SCG) Policy Manager versions earlier than 5.34.00.16 render their web interface without anti-framing protections, allowing a remote attacker to embed the authenticated UI inside an attacker-controlled page and overlay decoy content to trick an operator into unintended clicks, yielding session theft and elevation of privileges. Dell rates the issue CVSS 5.4 (AV:N/AC:L/PR:L/UI:N, C:L/I:L/A:N), while the assessed vector raises the user-interaction requirement to UI:R because clickjacking-style UI redressing practically depends on the victim clicking the framed content while holding a valid, low-privileged session. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; the vendor has released a fixed build, 5.34.00.16, so this is a moderate-severity, low-real-priority issue.
RemediationAI
Vendor-released patch: upgrade Dell Secure Connect Gateway (SCG) Policy Manager to version 5.34.00.16 or later, as documented in Dell advisory DSA-2026-385 (https://www.dell.com/support/kbdoc/en-ca/000503592/dsa-2026-385-security-update-for-dell-secure-connect-gateway-policy-manager-multiple-vulnerabilities). If the upgrade cannot be scheduled immediately, apply anti-framing headers at the reverse proxy or load balancer in front of the console - set X-Frame-Options: DENY (or SAMEORIGIN) and a Content-Security-Policy of frame-ancestors 'self' - which blocks the clickjacking vector but will also break any legitimate embedding or dashboard mash-ups that rely on framing the console, so validate integrations before enforcing. Additional compensating controls: restrict network reachability of the Policy Manager web UI to trusted administrative networks or VPN, since the attack requires the victim to browse to an attacker-controlled page while authenticated; shorten admin session idle timeouts and require re-authentication for sensitive actions to reduce the window in which a redressed click is useful; and instruct operators to avoid browsing untrusted sites in the same browser profile used to manage SCG, though user-behavior controls are weak substitutes for a real fix. Because exploitation requires a valid low-privileged session, rapid revocation of credentials and session tokens upon any suspected clickjacking incident limits the elevation-of-privilege impact.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-1021, Improper Restriction of Rendered UI Layers or Frames - a classic clickjacking / UI-redressing condition. SCG Policy Manager's web console does not send response headers such as X-Frame-Options or a Content-Security-Policy frame-ancestors directive, so browsers will happily render the console inside an <iframe> on any origin. An attacker who can host a page, or inject content into one, positions the legitimate console in a transparent or disguised frame and places look-alike controls on top; because the victim's own authenticated cookies are sent with the framed requests, any action the victim is induced to perform executes with that victim's privileges (CVSS PR:L, session hijacking effect). The credited CPE cpe:2.3:a:dell:secure_connect_gateway_(scg)_policy_manager:*:*:*:*:*:*:*:* indicates that all Policy Manager builds before the fixed revision are in scope, with no platform restriction. The accompanying intelligence tags mention XSS, which suggests the referenced Dell update (DSA-2026-385) bundles multiple web-layer hardening fixes in the same release; the CVE description itself attributes this specific entry to the missing frame restriction rather than to script injection. Note the discrepancy between Dell's UI:N vector and the assessed UI:R: frame-busting protections alone stop embedding, but converting the embed into privilege elevation or session theft still requires the victim to interact, which is why the independent assessment downgrades the practical severity.
Know when Secure Connect Gateway Scg Policy Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CWE-1021 frame-redress requires the authenticated victim to interact with the overlaid framed UI, so UI:R (not Dell's UI:N); impacts limited to C:L/I:L, no availability effect.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
1DescriptionCVE.org
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Rendered UI Layers or Frames vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges and Session theft.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Weak authentication throttling in Dell Secure Connect Gateway (SCG) Policy Manager allows unauthenticated remote attacke
Privilege escalation, filesystem access, and remote code execution in Dell Secure Connect Gateway (SCG) Policy Manager a
Authorization bypass in Dell Secure Connect Gateway (SCG) Policy Manager lets an authenticated, low-privileged user tamp
Improper X.509 certificate validation in Dell Secure Connect Gateway (SCG) Policy Manager lets an unauthenticated attack
Privilege escalation in Dell Secure Connect Gateway (SCG) Policy Manager allows an authenticated, network-reachable low-
Elevation of privilege in Dell Secure Connect Gateway (SCG) Policy Manager lets an attacker who already holds a valid lo
Improper TLS certificate validation in Dell Secure Connect Gateway (SCG) Policy Manager lets a man-in-the-middle who alr
Server-side request forgery in Dell Secure Connect Gateway (SCG) Policy Manager allows a remote attacker who already hol
Protection mechanism bypass in Dell Secure Connect Gateway (SCG) Policy Manager (versions below the vendor-fixed release
Cross-site request forgery in Dell Secure Connect Gateway (SCG) Policy Manager prior to the vendor-fixed build allows a
Local privilege escalation in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 lets a low-p
Unauthenticated remote attackers can reach a critical function in Dell Secure Connect Gateway (SCG) Policy Manager witho
Exploit-DB