Dell Secure Connect Gateway CVE-2026-79952

Exploitation requires no authentication and no special privileges - the CVSS vector confirms PR:N and AV:N, meaning the gateway's web interface must be reachable over the network by the attacker. Practical phishing exploitation additionally requires that the attacker can distribute a crafted URL to real users of the affected SCG instance (e.g., via phishing email targeting the organization's IT/operations staff who interact with the gateway). The vulnerability affects only the SCG 5.0 product line in both Appliance and Application forms; SCG versions at or above the patched thresholds (5.36.00.16 for Appliance, 5.36.00.00 for Application) are not affected. No special server configuration or feature enablement is stated as a prerequisite beyond running the vulnerable software version.

The CVSS 5.3 medium rating (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately conveys low infrastructure risk but is internally inconsistent with the stated phishing impact: phishing inherently requires victim interaction (UI:R) and affects integrity (I:L), yet the vendor scored UI:N and I:N. The C:L metric is plausible if the mechanism is an open redirect that leaks session tokens in the referrer or URL, but the primary harm is social engineering rather than direct data exfiltration. EPSS data is not provided; given medium severity, absence from CISA KEV, and no public proof-of-concept, exploitation probability is assessed as low. Real-world risk is primarily reputational and user-targeted: the gateway's brand trust makes it a useful phishing lure, and even a modest enterprise IT shop must apply the vendor patch to eliminate that attack surface. No compensating controls can fully substitute for the encoding fix, as the flaw lies in application output handling.

An attacker crafts a URL targeting the vulnerable SCG endpoint, embedding a malicious destination in a parameter that is reflected into the HTTP response without encoding - for example, as a redirect target or a rendered link. The attacker distributes this URL to Dell enterprise users via email or chat; because the URL's hostname belongs to the organization's legitimate SCG instance, standard phishing filters and user suspicion are bypassed. Victims who follow the link are redirected to or shown attacker-controlled content, enabling credential harvesting or malware delivery. No public proof-of-concept has been identified.