Secure Connect Gateway CVE-2026-79970

Network-accessible Dell SCG 5.0 management or API interface is reachable by the attacker. No authentication is required (PR:N per CVSS). AC:H indicates specific technical preconditions must be met - consistent with JWT attacks that require knowledge of the token format, algorithm in use, and ability to craft a specifically malformed or algorithm-confused token; this is not a trivial one-packet exploit. The vulnerability is present in default deployments of affected versions; no special non-default configuration is explicitly required per the description. Exploitation is limited by: (1) the high attack complexity requiring cryptographic knowledge and specific token crafting, (2) network reachability to the SCG interface which is typically restricted to internal/administrative networks in well-configured environments, and (3) the requirement to understand the product's JWT structure and accepted algorithms.

The vendor-supplied CVSS score of 5.6 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) reflects the high attack complexity inherent in exploiting a cryptographic signature flaw - typically requiring algorithm confusion, key confusion, or similar preconditions that are non-trivial to meet remotely. However, the Authentication Bypass and Jwt Attack tags suggest the real-world consequence of a successful exploit - forged tokens granting unauthorized access - is likely more severe than the C:L/I:L/A:L impact metrics convey; JWT-based authentication bypasses commonly yield broader system access proportional to the privileges the forged token asserts. No CISA KEV listing and no confirmed proof-of-concept exploit were present in the provided intelligence, indicating this has not yet attracted opportunistic mass exploitation. EPSS data was not supplied, leaving probabilistic exploitation likelihood unquantified. Even a mid-sized enterprise IT team in ustka managing Dell SCG appliances should treat this as a structured remediation priority rather than a deferred one, given that the unauthenticated network attack vector removes the need for any initial credential foothold, and the authentication bypass potential significantly amplifies post-exploitation reach if complexity is overcome.

An unauthenticated remote attacker identifies a publicly reachable Dell SCG 5.0 management interface and crafts a forged JWT - for example by exploiting an algorithm confusion weakness (substituting RS256 with HS256 using the public key as the HMAC secret) - that the server accepts as valid due to improper signature verification. The attacker submits the forged token to an authenticated API endpoint, bypassing access controls and gaining unauthorized access to SCG functionality. No public proof-of-concept has been confirmed at time of analysis, but the CWE-347/JWT combination represents a well-understood attack class with established tooling.