EUVD-2026-72404
GHSA-378r-2ff8-c4pr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach SCG service over network
-
DeliverySend request with path-traversal sequence
-
ExploitEscape restricted directory to executable path
-
ExecutionAppliance processes attacker file
-
PersistExecute code as service account
-
ImpactFull gateway compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker needs network access to the Dell Secure Connect Gateway 5.0 service interface and a vulnerable version (Appliance <5.36.00.16 or Application <5.36.00.00); per CVSS AV:N/AC:L/PR:N/UI:N no authentication, no user interaction, and no special non-default configuration is required, so a default-configured, network-exposed SCG instance is exploitable. The primary limiting factor is exposure: SCG is normally deployed inside an enterprise network reaching out to Dell support rather than internet-facing, so realistic exploitation depends on the attacker already having a foothold on a network segment that can route to the appliance. The exact vulnerable endpoint/parameter is not disclosed in the available data. |
| Impact | The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rates this as network-reachable, low-complexity, unauthenticated, no user interaction, with full confidentiality/integrity/availability impact - the profile of a critical pre-auth RCE. However, secondary signals temper the urgency: EPSS is low at 0.35% (28th percentile), no public POC is identified, and CISA's SSVC decision points list Exploitation as 'none' and Automatable as 'no', with Technical Impact only 'partial'. The SSVC 'partial' technical impact directly conflicts with the CVSS all-high C:H/I:H/A:H rating - one of these characterizations overstates or understates impact and should be verified against Dell's advisory. Net assessment: this is a genuine high-priority patch target because of the pre-auth network RCE potential on an infrastructure appliance, but current evidence points to no active exploitation, so it warrants prompt scheduled patching rather than emergency out-of-band response. |
| Exploit ScenarioDerived | An attacker with network reachability to the SCG service sends a crafted request containing directory-traversal sequences in a pathname parameter, escaping the intended directory to write or reference a file in an executable location. When the appliance processes that file, attacker-controlled code runs in the service context, giving full compromise of the gateway. No public POC is identified at time of analysis, and the low CVSS attack complexity (AC:L) with no authentication (PR:N) means a working exploit, if developed, would be straightforward to weaponize. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 09, 2026
Remote code execution in Dell Secure Connect Gateway (SCG) 5.0 allows an unauthenticated remote attacker to exploit a path-traversal flaw and execute code on the appliance. Both the Appliance edition (before 5.36.00.16) and the Application edition (before 5.36.00.00) of the SCG 5.0 virtual-edition telemetry/remote-support gateway are affected. There is no public exploit identified at time of analysis; EPSS estimates a modest 0.35% (28th percentile) exploitation probability and CISA's SSVC framework lists exploitation status as none.
Earlier versions of this analysis (1)
Path traversal (CWE-22) in Dell Secure Connect Gateway 5.0 permits unauthenticated remote attackers to escape the restricted directory sandbox and achieve remote code execution on both the hardware Appliance and virtual Application deployments. The CVSS vector (AV:N/AC:H/PR:N/UI:N/C:L/I:H/A:N) reveals a primarily write-side traversal primitive - an attacker can write arbitrary files to the underlying filesystem, enabling code execution via malicious file placement, though high attack complexity limits opportunistic exploitation. Dell has patched both product variants under advisory DSA-2026-382; no public exploit code or CISA KEV listing has been identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade the Appliance edition to 5.36.00.16 or later and the Application edition to 5.36.00.00 or later, per Dell advisory DSA-2026-382 (https://www.dell.com/support/kbdoc/en-in/000503426/dsa-2026-382-security-update-for-dell-secure-connect-gateway-virtual-edition-multiple-vulnerabilities). Because both SKUs are patched under the same advisory, confirm which edition is deployed before applying. If immediate patching is not possible, restrict network reachability to the SCG management/service interface - place it behind a firewall or ACL so only Dell support endpoints and authorized administrative hosts can reach its listening ports, which reduces the unauthenticated-remote exposure at the cost of potentially disrupting automated telemetry/case-creation flows if legitimate Dell traffic is inadvertently blocked; monitor appliance filesystem and process activity for anomalous file writes as a detection compensating control.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Dell Secure Connect Gateway is a virtual-edition gateway that connects Dell hardware/software estates to Dell support for automated telemetry, case creation, and remote support/updates, typically deployed inside enterprise data-center networks. The root cause is CWE-22, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): the service fails to properly canonicalize or constrain a user-supplied pathname, letting an attacker reference files outside the intended directory using traversal sequences. Per the CPE data, two distinct SKUs are in scope - cpe:2.3:a:dell:secure_connect_gateway_5.0_-_application and cpe:2.3:a:dell:secure_connect_gateway_5.0_-_appliance - indicating both the standalone application package and the packaged virtual appliance share the vulnerable code path. Dell's description states the traversal chains into remote code execution, implying the traversal is write-capable or reaches an executable path (e.g., uploading/overwriting a file into an interpreted or startup location) rather than a read-only file disclosure.
Know when Secure Connect Gateway 5 0 Appliance gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable path traversal leading to code execution gives PR:N/UI:N/AC:L and full C/I/A impact; consistent with Dell's 9.8, though SSVC 'partial' impact suggests C/I/A could be lower.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution.
Executive ViewAI
Dell Secure Connect Gateway 5.0 (Appliance and Application editions) contains a critical vulnerability allowing unauthenticated attackers to remotely execute code on the telemetry and support gateway. This directly threatens the organization's remote-support infrastructure and could provide attackers a foothold into critical systems. All instances running versions before 5.36.00.16 (Appliance) or 5.36.00.00 (Application) require immediate patching.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote code execution in Dell Secure Connect Gateway (SCG) 5.0 allows an unauthenticated remote attacker to escape the i
Unauthorized ADMIN access in Dell Secure Connect Gateway (SCG) 5.0 allows a remote unauthenticated attacker to replay a
Remote command execution in Dell Secure Connect Gateway 5.0 (Appliance versions before 5.36.00.16 and Application versio
Unauthorized remote access to Dell Secure Connect Gateway (SCG) 5.0 is possible because the product fails to properly va
Relative path traversal in Dell Secure Connect Gateway (SCG) 5.0 allows a low-privileged remote attacker to traverse dir
Missing authentication on critical API functions in Dell Secure Connect Gateway (SCG) 5.0 exposes privileged operations
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows remote unauthenticated attackers to expl
Relative path traversal in Dell Secure Connect Gateway 5.0 (both Appliance and Application editions) exposes unauthentic
Dell Secure Connect Gateway (SCG) 5.0 exposes a critical management function without any authentication requirement (CWE
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 enables a locally authenticated low-privilege attacker to
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 - both Appliance (prior to 5.36.00.16) and Application (pr
Local privilege escalation in Dell Secure Connect Gateway 5.0 enables a low-privileged authenticated user with local she
Exploit-DB