EUVD-2026-75043
GHSA-4f4c-f6w3-8rrm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach SCG service over network
-
DeliverySend request with command metacharacters
-
ExploitInjected input reaches command interpreter
-
ExecutionCommands execute in gateway context
-
ImpactCompromise support-gateway data and connectivity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Dell SCG 5.0 service on an unpatched instance (Appliance < 5.36.00.16 or Application < 5.36.00.00). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special configuration are needed - remote unauthenticated exploitation against default configurations of Dell Secure Connect Gateway 5.0. The primary limiting factor is exposure: SCG is a support-connectivity appliance typically deployed inside management networks rather than internet-facing, so real-world reach depends on how broadly the service interface is exposed; the described outcome ('script injection', SSVC technical impact partial) may also constrain the actual blast radius versus the full-triad CVSS rating. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes a worst-case remote, unauthenticated, no-interaction attack with full triad impact - a clear patch-now profile on paper. However, several signals temper the raw score: CISA's SSVC rates Technical Impact as 'partial' (not total), and the Dell description frames the outcome as 'script injection' rather than confirmed full OS command execution, so the real integrity/confidentiality reach may be narrower than C:H/I:H/A:H suggests - verify scope with Dell. SSVC Exploitation is 'none' and no POC or KEV listing is present, so there is no evidence of active exploitation today. The offsetting factor is SSVC Automatable=yes: an unauthenticated network-reachable command-injection endpoint is highly scannable, so exposure should be treated as urgent for any internet- or management-network-facing SCG instance even absent an in-the-wild exploit. |
| Exploit ScenarioDerived | An attacker who can reach the SCG service over the network sends a crafted request containing shell/command metacharacters to a vulnerable input field; because the input is passed to a command interpreter without neutralization, the injected commands run in the gateway's context. Since the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires no credentials, no user interaction, and low complexity - and SSVC marks it automatable, so it could be driven by a scripted scanner across exposed instances. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 09, 2026
Command injection in Dell Secure Connect Gateway (SCG) 5.0 - both the Appliance (before 5.36.00.16) and Application (before 5.36.00.00) variants - allows an unauthenticated remote attacker to inject and execute commands, described by Dell as script injection. The CVSS 9.8 vector rates all three impacts as high (C:H/I:H/A:H), though CISA SSVC scores the technical impact as only partial. No public exploit identified at time of analysis and SSVC exploitation status is 'none', but the flaw is marked automatable, raising the risk of scanning-driven mass exploitation once a technique surfaces.
Earlier versions of this analysis (1)
Command injection in Dell Secure Connect Gateway (SCG) 5.0 allows remote unauthenticated attackers to inject scripts through network-accessible endpoints, potentially exposing limited system information. Both deployment form factors are affected: the Appliance prior to version 5.36.00.16 and the Application prior to version 5.36.00.00. No public exploit code or active exploitation has been identified at time of analysis, and Dell has released patched versions via advisory DSA-2026-382.
RemediationAI
Apply the vendor patch: upgrade the SCG 5.0 Appliance to 5.36.00.16 or later and the SCG 5.0 Application to 5.36.00.00 or later, per Dell advisory DSA-2026-382 (https://www.dell.com/support/kbdoc/en-in/000503426/dsa-2026-382-security-update-for-dell-secure-connect-gateway-virtual-edition-multiple-vulnerabilities), which addresses this and several related SCG vulnerabilities in the same release. Until patching is complete, restrict network reachability of the SCG management/service interface to trusted administrative networks only and place it behind a firewall or ACL so unauthenticated internet or general-LAN clients cannot reach the vulnerable endpoint - the trade-off is that overly tight restrictions can interrupt SCG's outbound support telemetry and case automation, so scope rules to the specific ingress paths rather than blocking the appliance's Dell-bound connectivity. Monitor the appliance for anomalous process execution as a detective control.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Dell Secure Connect Gateway is Dell's remote support and telemetry gateway (virtual-edition appliance plus companion application) that brokers automated case creation, monitoring, and secure connectivity between customer infrastructure and Dell support back-ends. The affected products are identified by CPE cpe:2.3:a:dell:secure_connect_gateway_5.0_-_application and cpe:2.3:a:dell:secure_connect_gateway_5.0_-_appliance. The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command), meaning attacker-supplied input reaches a command interpreter without adequate sanitization, letting crafted metacharacters alter the intended command. This is a sibling issue to other DSA-2026-382 findings in the same product (e.g. CVE-2026-79689 OS command injection and CVE-2026-80131 path-traversal RCE), indicating a cluster of input-handling weaknesses fixed in the same release.
Know when Secure Connect Gateway 5 0 Appliance gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network command injection with no interaction warrants AV:N/AC:L/PR:N/UI:N; command execution supports high triad impact, though vendor 'script injection' wording and SSVC 'partial' could lower it.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to script injection.
Executive ViewAI
Dell Secure Connect Gateway (SCG) 5.0 contains a critical unauthenticated command injection vulnerability allowing remote attackers to execute arbitrary commands on the gateway appliance without any authentication. Organizations using SCG for secure remote access face immediate risk of unauthorized access, complete gateway compromise, and data exposure through infrastructure trusted for access control. The vulnerability is marked automatable, creating urgent timelines for patching before public exploitation techniques surface.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Remote code execution in Dell Secure Connect Gateway (SCG) 5.0 allows an unauthenticated remote attacker to escape the i
Unauthorized ADMIN access in Dell Secure Connect Gateway (SCG) 5.0 allows a remote unauthenticated attacker to replay a
Remote command execution in Dell Secure Connect Gateway 5.0 (Appliance versions before 5.36.00.16 and Application versio
Unauthorized remote access to Dell Secure Connect Gateway (SCG) 5.0 is possible because the product fails to properly va
Relative path traversal in Dell Secure Connect Gateway (SCG) 5.0 allows a low-privileged remote attacker to traverse dir
Missing authentication on critical API functions in Dell Secure Connect Gateway (SCG) 5.0 exposes privileged operations
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows remote unauthenticated attackers to expl
Relative path traversal in Dell Secure Connect Gateway 5.0 (both Appliance and Application editions) exposes unauthentic
Dell Secure Connect Gateway (SCG) 5.0 exposes a critical management function without any authentication requirement (CWE
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 enables a locally authenticated low-privilege attacker to
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 - both Appliance (prior to 5.36.00.16) and Application (pr
Local privilege escalation in Dell Secure Connect Gateway 5.0 enables a low-privileged authenticated user with local she
Exploit-DB