Dell Secure Connect Gateway CVE-2026-79738

No special runtime configuration is required - the hardcoded credential is present in all SCG 5.0 Appliance versions prior to 5.36.00.16 and all SCG 5.0 Application versions prior to 5.36.00.00 by default. The primary limiting factor is credential discovery: an attacker must first obtain the hardcoded credential value, typically through reverse engineering of the product binary, leaked documentation, or prior public disclosure. The SCG service must be network-reachable from the attacker's position; if the management interface is firewalled to trusted hosts only, exploitation is prevented at the network layer. There is no user interaction requirement and no non-default configuration needed to introduce the vulnerability - it exists in all unpatched deployments out of the box.

The CVSS 7.5 score with AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N accurately reflects a remotely exploitable, zero-prerequisite information disclosure - even a mid-sized municipal IT team in sanok running SCG for remote support management should treat this as urgent given the complete lack of authentication barrier once the hardcoded credential is known. EPSS data is not provided, and the vulnerability does not appear in CISA KEV, suggesting exploitation has not yet been observed at scale. No public proof-of-concept code is identified. However, hardcoded-credential flaws are historically low-complexity to exploit once the credential value is extracted from firmware or reverse-engineered - the primary unknown is whether the static credential has been publicly disclosed. Confidentiality impact is rated High (C:H) with no integrity or availability effect, aligning with Dell's description of information exposure. The attack complexity is genuinely low once the credential is known, which is the key risk multiplier here.

An attacker who has extracted the hardcoded credential from a publicly available SCG software package or documentation sends authentication requests directly to the SCG network service, successfully logging in without any legitimate account. Once authenticated, the attacker retrieves sensitive configuration or operational data exposed by the SCG platform. No proof-of-concept code has been publicly identified, but the low complexity of this class of attack makes manual exploitation straightforward once the credential value is known.