Dell Secure Connect Gateway CVE-2026-79642

Exploitation requires the attacker to achieve a network-level man-in-the-middle position between the Dell SCG deployment and the remote endpoint (e.g., Dell support infrastructure or a backend service the SCG communicates with). This prerequisite is reflected in the CVSS AC:H metric and rules out direct opportunistic exploitation from the open internet. No authentication is required (CVSS PR:N). The vulnerability is present in default operation of both Appliance and Application deployment modes - no special SCG feature or non-default configuration needs to be enabled. Limiting factors include: (1) MITM network positioning is a meaningful operational barrier that excludes unsophisticated or remote-only threat actors; (2) impact is bounded to interception or modification of SCG communications rather than OS-level or full host compromise; (3) only SCG 5.0 versions below the patched releases are affected.

The CVSS 5.6 base score with AC:H accurately reflects a moderate-priority vulnerability constrained by the MITM prerequisite, limiting opportunistic internet-scale exploitation. The C:L/I:L/A:L impact metrics indicate partial exposure of communications rather than full host compromise, consistent with a TLS interception flaw. Neither EPSS data nor a KEV listing was supplied, so exploitation probability and active-exploitation status cannot be independently quantified; no public exploit is known. The primary real-world risk is interception of Dell-to-enterprise support telemetry in environments where LAN-level or network-path traffic can be intercepted - even a mid-sized municipal IT team in walbrzych operating Dell SCG for enterprise remote support should treat this as a meaningful patching priority given the product's role in transmitting potentially sensitive diagnostic and configuration data. The CVSS AC:H vector confirms that exploitation is not trivially automatable, making mass exploitation unlikely, but the PR:N (no authentication required) component means any positioned attacker - regardless of account status - can attempt the attack.

An attacker with network MITM capability - achieved via ARP poisoning on a shared LAN segment, a compromised upstream router, or a rogue access point - intercepts outbound TLS connections from the Dell SCG appliance to Dell support infrastructure. Because the SCG fails to validate the server certificate, the attacker substitutes their own certificate, successfully terminating the encrypted session and gaining plaintext access to support telemetry, diagnostic commands, or credentials transmitted over that channel. No public exploit code is known, but the attack is mechanically straightforward for any attacker already positioned on the network path.