Dell SCG CVE-2026-79638

No authentication is required and no special user interaction is necessary per the CVSS PR:N/UI:N vector - remote unauthenticated exploitation is possible against default-configuration Dell SCG 5.0 instances accessible over the network. The limiting factor is that SCG is a purpose-built enterprise gateway not typically exposed directly to the internet; organizations that restrict SCG management access to internal networks or VPN significantly reduce practical exploitability. The UI:N rating is atypical for XSS and requires vendor clarification - if the actual surface is reflected XSS, a victim would need to visit a crafted URL, effectively adding UI:R as a limiting condition not reflected in the current CVSS vector.

The CVSS base score of 5.3 (Medium) appropriately reflects the limited impact ceiling - C:L/I:N/A:N - but the PR:N/AV:N/AC:L attack conditions warrant attention given the unauthenticated remote exploitation path. The UI:N metric is atypical for XSS vulnerabilities and may indicate stored XSS with auto-rendering or a server-side injection surface; this should be verified with the vendor advisory, as reflected XSS would ordinarily carry UI:R. EPSS data was not provided, and the absence of KEV listing and public POC keeps this in lower-priority territory for most environments - even a mid-sized municipal IT team in zabrze managing mixed-vendor infrastructure would reasonably defer this below critical-severity issues, provided the gateway is not internet-exposed. The primary practical risk is unauthorized session-context information disclosure if a privileged user's browser executes injected script. Dell SCG is not a universally deployed product, limiting blast radius to organizations with Dell remote-support infrastructure.

An unauthenticated attacker identifies a Dell SCG 5.0 instance accessible over the network and submits a crafted request containing alternate XSS syntax (e.g., non-standard encoding, obfuscated tag variants) to a vulnerable input field or endpoint that bypasses the gateway's sanitization logic. The injected script is subsequently rendered in the browser of a user accessing the SCG interface, allowing the attacker to read session-context data such as authentication tokens or page content. No public POC has been identified, but the low attack complexity (AC:L) suggests a straightforward bypass once the alternate syntax form is known.