Secure Connect Gateway CVE-2026-78483

Exploitation requires the attacker to establish a network man-in-the-middle position between the Dell SCG instance and its remote communication target - this is a non-default, non-trivial prerequisite (reflected in CVSS AC:H). The attacker must be able to intercept TCP/IP traffic on the relevant network path, for example by being on the same Layer 2 segment and performing ARP poisoning, or by controlling a network device in the routing path. No authentication to the SCG or victim system is required. Exploitation is limited to scenarios where the attacker controls the network path; remote attackers without that network adjacency or routing control cannot exploit this vulnerability. The affected SCG versions are prior to 5.36.00.16 (Appliance) and prior to 5.36.00.00 (Application); patched systems are not vulnerable.

The provided CVSS 3.1 score of 5.9 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N accurately reflects the real-world attack bar. The AC:H metric is the dominant risk-reducing factor: successful exploitation requires the attacker to occupy a network-interception position between the SCG and the remote endpoint (a man-in-the-middle posture), which is a non-trivial prerequisite that significantly limits opportunistic exploitation. No KEV listing, no POC, and no EPSS data are available in this submission, so no escalating signals exist beyond the CVSS assessment. The C:H impact is significant - a compromised SCG channel could expose Dell support credentials, device telemetry, or administrative commands transiting the gateway. The I:N score (no integrity impact) may be conservative, as a true MITM also enables traffic injection; however, the vendor's framing of 'protection mechanism bypass' aligns with a primarily confidentiality-focused impact. Real-world risk is moderate: exploitation is feasible only in environments where an attacker can position between the SCG and its upstream endpoint (e.g., on the same network segment or via a compromised upstream hop). Organizations exposing SCG to untrusted networks face higher risk.

An attacker with network access to traffic between the Dell SCG and its remote endpoint - for example, via ARP spoofing on the local network or compromise of an upstream router - presents a forged TLS certificate during the SCG's outbound connection handshake. Because SCG fails to properly validate the certificate, the TLS session is established with the attacker's endpoint, allowing all transmitted data (potentially including support credentials or device telemetry) to be read in plaintext. No public proof-of-concept code is known at time of analysis.