Dell SCG CVE-2026-80177

Exploitation requires a valid low-privilege account on the Dell SCG 5.0 instance (PR:L per CVSS vector) and standard network connectivity to the SCG management interface (AV:N/AC:L). No user interaction is required. The vulnerability is constrained to SCG 5.0 Appliance versions below 5.36.00.16 and Application versions below 5.36.00.00. Exploitation is limited by the requirement for at least low-privilege authentication - unauthenticated exploitation is not indicated by the CVSS vector. Environments that restrict SCG management access to a dedicated administrative network or VPN substantially reduce real-world exposure.

The vendor-assigned CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a remotely exploitable, low-complexity flaw requiring only low-privilege credentials - a realistic bar in enterprise environments where SCG users frequently hold service-level accounts. The confidentiality impact is rated High, consistent with the ability to exfiltrate backend database contents including potentially sensitive support metadata, credentials, or asset inventory. Integrity and availability are scored N, though the description's mention of 'script injection' introduces ambiguity: if injected content persists and is rendered in the UI, some integrity impact (e.g., stored XSS via SQL write-path) may exist but is not reflected in the vendor CVSS. No EPSS data was provided; without KEV listing or public POC, immediate opportunistic exploitation at scale is not confirmed. Real-world priority is moderate: enterprise-only deployment limits surface area, but low-privilege access is a realistic attacker foothold and C:H on a support gateway that aggregates sensitive device and credential data elevates operational risk.

An attacker with a low-privilege SCG service account - obtained via credential stuffing, leaked credentials from a prior breach, or default account enumeration - sends a crafted HTTP request containing SQL metacharacters to a vulnerable SCG endpoint. The malformed parameter is interpolated directly into a backend SQL query, returning database contents such as registered device metadata, support credentials, or internal configuration data. If script injection via SQL write-path is viable, the attacker could additionally persist a script payload surfaced to other SCG users.