Secure Connect Gateway CVE-2026-79731

Any Dell Secure Connect Gateway 5.0 Appliance prior to 5.36.00.16 or Application prior to 5.36.00.00 that is reachable over the network is potentially vulnerable - no special non-default configuration is required beyond the product being deployed. Exploitation is constrained by the need to first discover the hard-coded credentials through firmware reverse engineering, binary analysis, or network traffic capture, which introduces meaningful attacker effort. The CVSS PR:H metric directly contradicts the description's 'unauthenticated attacker' characterization - the true authentication requirement is therefore not definitively confirmed from available data, and security teams should treat the credential-discovery step as the primary limiting factor rather than any access-control gate. Once credentials are known or publicly disclosed, the effective attack complexity drops to low.

The vendor-assigned CVSS score of 4.4 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) contains a direct internal inconsistency: the vulnerability description explicitly states exploitation is possible by 'an unauthenticated attacker with remote access,' yet PR:H (high privileges required) is assigned. For CWE-798, PR:H is anomalous - the hard-coded credential itself substitutes for attacker-supplied authentication, making PR:N the more accurate metric. The AC:H is more defensible if it reflects the prerequisite of first discovering the embedded credentials through firmware extraction or binary reverse engineering. A corrected vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) yields a base score of approximately 5.9. EPSS data was not provided. No KEV listing or public PoC is confirmed. Practical risk is moderate: the confidentiality-only impact (C:H, I:N, A:N) caps the damage ceiling, and the credential-discovery prerequisite provides a temporary friction layer - one that evaporates if credentials are independently published or reverse-engineered.

An attacker with network reachability to an unpatched Dell SCG 5.0 instance obtains a copy of the appliance firmware or application binary through public sources or prior access, extracts the hard-coded credentials via static analysis, and then remotely authenticates to the SCG management interface using those credentials to exfiltrate sensitive configuration or telemetry data. No public exploit code has been identified at time of analysis, so exploitation currently requires independent credential-extraction effort.