EUVD-2026-72406
GHSA-2938-h5j3-3ph2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach SCG 5.0 service over network
-
DeliverySend crafted path-traversal request
-
ExploitEscape restricted directory
-
ExecutionWrite/execute attacker-controlled content
-
ImpactAchieve remote code execution on gateway
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) and description, exploitation requires only remote network access to a vulnerable Dell SCG 5.0 instance (Appliance <5.36.00.16 or Application <5.36.00.00) with no authentication and no user interaction against default configurations. The primary limiting factor is network reachability: the attacker must be able to reach the SCG service/management interface, so instances confined to isolated management segments with restricted inbound access are substantially harder to exploit. Exploitation is also version-bounded - only SCG 5.0 builds below the fixed versions are vulnerable. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes the worst-case profile: network-reachable, low complexity, no privileges, no user interaction, and full confidentiality/integrity/availability impact via code execution. This is internally consistent with the description ('unauthenticated attacker with remote access'). However, the exploitation signals temper the raw score: EPSS is only 0.43% (36th percentile) and the vulnerability is NOT in CISA KEV, so there is no evidence of active or widespread exploitation to date; POC availability is unconfirmed. The CVSS 9.8 therefore reflects theoretical maximum impact rather than demonstrated exploitation activity. SCG's role as a support/telemetry gateway means it is often deployed with outbound-heavy but restricted inbound exposure, which may limit real-world reachability. Net assessment: a genuinely high-severity, patch-worthy issue given unauthenticated-RCE potential, but not currently an emergency-tier actively-exploited threat - prioritize based on internet/management-network exposure of the SCG instance. |
| Exploit ScenarioDerived | An attacker who can reach the SCG 5.0 service over the network sends a crafted request containing directory-traversal sequences in a path parameter, escaping the restricted directory to write or reach a location where the content is executed. This yields arbitrary code execution on the gateway with no credentials and no user interaction, giving the attacker a foothold on a system that bridges customer infrastructure and Dell support connectivity. No public POC is confirmed, so exploitation currently requires independent development of the traversal-to-RCE chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 09, 2026
Remote code execution in Dell Secure Connect Gateway (SCG) 5.0 allows an unauthenticated remote attacker to escape the intended directory and execute arbitrary code by supplying crafted path input. Both the Appliance (versions before 5.36.00.16) and the Application (versions before 5.36.00.00) deployments of SCG 5.0 Virtual Edition are affected. No public exploit identified at time of analysis, and the flaw is not in CISA KEV; EPSS is a modest 0.43% (36th percentile), but the network-reachable, unauthenticated path-traversal-to-RCE profile warrants prompt patching.
Earlier versions of this analysis (1)
Path traversal in Dell Secure Connect Gateway (SCG) 5.0 allows unauthenticated remote attackers to break out of the application's restricted directory sandbox, with Dell's advisory explicitly citing remote code execution as the consequence. Both the virtual Appliance deployment (prior to 5.36.00.16) and the Application deployment (prior to 5.36.00.00) are affected. Vendor patch is available via DSA-2026-382; no public exploit code or CISA KEV listing has been identified at the time of analysis.
RemediationAI
Vendor-released patch: upgrade the SCG 5.0 Appliance to 5.36.00.16 or later, and the SCG 5.0 Application to 5.36.00.00 or later, as directed in Dell DSA-2026-382 (https://www.dell.com/support/kbdoc/en-in/000503426/dsa-2026-382-security-update-for-dell-secure-connect-gateway-virtual-edition-multiple-vulnerabilities). Because the advisory covers multiple vulnerabilities, apply the full cumulative update rather than a partial fix. Until patching is complete, restrict network reachability of the SCG management/service interfaces to trusted administrative segments only and block untrusted inbound access at the firewall - since SCG primarily needs outbound connectivity to Dell, tightly restricting inbound access has limited operational side effects while removing the unauthenticated remote attack surface. Monitor SCG logs and filesystem for unexpected files written outside expected directories as a detection compensating control.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Dell Secure Connect Gateway is Dell's remote support/telemetry gateway (Virtual Edition), the successor to SupportAssist Enterprise, used to relay device monitoring, automated case creation, and remote-support connectivity between customer infrastructure and Dell support. The affected CPEs are cpe:2.3:a:dell:secure_connect_gateway_5.0_-_application and cpe:2.3:a:dell:secure_connect_gateway_5.0_-_appliance. The root cause is CWE-22, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): the application fails to properly neutralize '../' or absolute-path sequences in attacker-supplied input, allowing access to files outside the intended directory. Per the description this traversal escalates to remote code execution, implying the traversal reaches a location where attacker-controlled content is written to or read from an executable/interpreted context (e.g., writing into a web-served or auto-loaded directory).
Know when Secure Connect Gateway 5 0 Appliance gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description confirms unauthenticated remote access (AV:N/PR:N/UI:N) leading to code execution, which yields full C/I/A impact; low complexity per vendor vector.
Primary rating from Vendor (dell).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution.
Executive ViewAI
Dell Secure Connect Gateway (SCG) 5.0 deployments face critical remote code execution risk from unauthenticated network attackers exploiting path traversal to bypass access controls. Organizations running SCG 5.0 Appliance or Virtual Edition must patch immediately, as compromise could expose all privileged access sessions and gateway operations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Unauthorized ADMIN access in Dell Secure Connect Gateway (SCG) 5.0 allows a remote unauthenticated attacker to replay a
Remote command execution in Dell Secure Connect Gateway 5.0 (Appliance versions before 5.36.00.16 and Application versio
Unauthorized remote access to Dell Secure Connect Gateway (SCG) 5.0 is possible because the product fails to properly va
Relative path traversal in Dell Secure Connect Gateway (SCG) 5.0 allows a low-privileged remote attacker to traverse dir
Missing authentication on critical API functions in Dell Secure Connect Gateway (SCG) 5.0 exposes privileged operations
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows remote unauthenticated attackers to expl
Relative path traversal in Dell Secure Connect Gateway 5.0 (both Appliance and Application editions) exposes unauthentic
Dell Secure Connect Gateway (SCG) 5.0 exposes a critical management function without any authentication requirement (CWE
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 enables a locally authenticated low-privilege attacker to
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 - both Appliance (prior to 5.36.00.16) and Application (pr
Local privilege escalation in Dell Secure Connect Gateway 5.0 enables a low-privileged authenticated user with local she
Privilege escalation in Dell Secure Connect Gateway (SCG) 5.0 allows a local attacker with basic system access to gain f
Exploit-DB