Dell Secure Connect Gateway CVE-2026-78487

Exploitation requires a local account on the Dell SCG host with at minimum low-privilege (PR:L per CVSS). The attacker must be able to read the application binary or associated configuration files to extract the hard-coded key. Remote unauthenticated exploitation is not possible - the attack vector is strictly local (AV:L). What limits exploitation: the attacker must already have a valid local OS account (no unauthenticated or network-remote path is described); no user interaction from a privileged user is needed once access is established (UI:N); and impact is limited to confidentiality - data integrity and availability are unaffected.

The CVSS 3.1 base score of 5.5 (Medium) accurately reflects the local-access prerequisite (AV:L), which substantially constrains real-world exploitability - an attacker must already have a foothold on the host system with at minimum a low-privileged account. Despite the C:H rating, the attack surface is limited to insiders, compromised accounts, or attackers who have achieved prior local code execution. No EPSS data was provided; the score is expected to be low given the local-only attack vector and absence of public exploit code. The vulnerability is not listed in the CISA KEV catalog. The primary real-world risk scenario is a malicious insider or a post-compromise lateral-movement step where an attacker leverages the known key to decrypt SCG-protected data (potentially service credentials, API tokens, or configuration secrets). The absence of integrity or availability impact (I:N/A:N) further limits blast radius. Overall this is a genuine but non-critical finding that warrants patching within a normal patch cycle rather than emergency response.

An attacker with a low-privileged local account on the Dell SCG host - whether a malicious insider or an adversary who has achieved initial access through a separate vulnerability - reverse-engineers the application binary or reads packaged configuration files to extract the embedded static cryptographic key. The attacker then uses the recovered key to decrypt data protected by that key, potentially exposing stored service credentials, API tokens, or sensitive configuration material. No public exploit code is known at time of analysis, but the technique is straightforward for anyone with local read access to the application files.