Dell SCG CVE-2026-80167

Exploitation requires an attacker to have local authenticated access to the Dell SCG 5.0 host OS with at least low-privilege (non-root) credentials - consistent with CVSS PR:L and AV:L. The vulnerability exists in both the virtual appliance and software application deployment modes of SCG 5.0. No network-facing vector is described; exploitation cannot occur remotely without first obtaining local access through another means. The attack is constrained to SCG 5.0 Appliance versions below 5.36.00.16 and SCG 5.0 Application versions below 5.36.00.00; fully patched systems are not affected. No special feature flag or non-default configuration is required beyond having the affected software installed.

The CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately captures the threat model: confidentiality impact is high because a recovered hardcoded key can decrypt protected data universally across all unpatched deployments, but the local-access and low-privilege prerequisites substantially reduce exploitability. No EPSS score was provided in the source data; however, the local attack vector, the absence of KEV listing, and the absence of public POC all indicate low near-term exploitation probability. The primary real-world risk is insider threat or post-compromise lateral movement: an attacker who already has local shell access on the SCG appliance or VM can extract the embedded key and potentially decrypt captured telemetry or credentials stored by the gateway. The scope-unchanged rating (S:U) suggests no direct pivot to other systems via the vulnerability itself, though decrypted data may enable further attacks. Overall this is a genuine medium-severity finding requiring patching but is not an emergency for organizations without insider-threat exposure.

An attacker with a low-privileged local shell account on a Dell SCG 5.0 appliance - such as a disgruntled employee or an adversary who has already achieved initial access via another vulnerability - reverse-engineers the SCG application binary or scans configuration files to locate the embedded cryptographic key. The attacker then uses that key to decrypt sensitive data stored or transmitted by the gateway, such as support credentials or encrypted telemetry, potentially enabling further lateral movement. No public exploit code exists at time of analysis, so this remains a post-compromise technique rather than a standalone attack.