Dell Secure Connect Gateway CVE-2026-80170

The SCG management interface must be network-reachable from the attacker's position - if exposed to the internet or accessible from an untrusted network segment, exploitation risk is heightened. Both the Application (software/VM) and Appliance (hardware) deployment forms are affected, so the condition applies regardless of deployment type. The attacker must know or independently discover the hard-coded credential value; once known, exploitation requires only network access and no legitimate user account. What limits exploitation: the credential value itself must be obtained (not publicly documented in the advisory), and the management interface must not be restricted to authorized management networks by firewall or host-based access controls.

The vendor-assigned CVSS 6.5 with PR:L conflicts with the description's explicit statement of 'unauthenticated attacker,' a discrepancy that materially affects risk scoring; the PR:L assignment may reflect that the hardcoded credential itself provides only low-privilege access, while the description emphasizes that no attacker-supplied credential is required. Real-world priority is moderate: the attack vector is network-accessible (AV:N/AC:L), the credentials are deterministic (AC:L), and the confidentiality impact is high - meaning an attacker who identifies the credential can extract sensitive information from any unpatched instance network-reachable from the internet. Even a mid-sized municipal IT team in bytom relying on Dell SCG for remote support connectivity should treat this as urgent given the product's role in support infrastructure. No KEV listing and no public exploit code have been identified, and EPSS data is not provided, so opportunistic mass exploitation is not currently evidenced - but hardcoded credentials are highly amenable to automated scanning once the credential value is known or reverse-engineered.

An attacker who has obtained the hard-coded credential - through binary reverse engineering of the SCG software package, a public disclosure, or prior research - sends authenticated requests to the SCG management API over the network using that credential. Because no legitimate user account or elevated privilege is required on the attacker's part, they can extract sensitive configuration data, support session logs, or credential material stored within the gateway. No public exploit code has been identified at time of analysis.