Dell Secure Connect Gateway CVE-2026-78485

No special configuration is required - the vulnerability is exploitable by any unauthenticated attacker with network-layer access to the Dell SCG 5.0 interface (CVSS PR:N/AC:L/AV:N). Both the Appliance and Application deployment forms are affected. Exploitation is limited to network-reachable instances; SCG gateways deployed behind firewall rules that restrict management-interface access to internal IP ranges or VPN tunnels are significantly harder to exploit from external networks. Version is a hard constraint: only versions prior to 5.36.00.16 (Appliance) and 5.36.00.00 (Application) are vulnerable.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) reflects unauthenticated, low-complexity, network-accessible exploitation, yielding a score of 7.3. The PR:N and AC:L combination is consistent with the description's statement of 'unauthenticated attacker with remote access' - no credentials or special conditions are required. The vendor has assigned Low impact across Confidentiality, Integrity, and Availability; however, the description only explicitly mentions 'Unauthorized access,' which more naturally maps to confidentiality impact. The I:L and A:L designations are not independently substantiated by the description and may be overstated if the traversal is read-only. No EPSS data was provided, KEV status is negative, and no public proof-of-concept has been identified, which moderates urgency despite the unauthenticated network vector. SCG gateways are high-value enterprise targets because they mediate Dell support tunnels, and unauthorized file read on such a device could expose sensitive credentials or configuration data with outsized downstream impact.

An unauthenticated attacker with network access to the SCG management interface sends a crafted HTTP request containing path traversal sequences (e.g., '../../etc/passwd' or equivalent) to bypass the intended directory restriction. The server resolves the manipulated path and returns file contents from outside the restricted directory, potentially exposing configuration files, credentials, or internal gateway data. No exploit code has been publicly released, but the low complexity of directory traversal attacks means skilled attackers can craft payloads manually without specialized tooling.