Dell Secure Connect Gateway EUVD-2026-72454

Exploitation requires an authenticated local session on the SCG host with at least low-privilege user rights (PR:L per CVSS); remote unauthenticated exploitation is not possible. The attacker must have local filesystem or process-level access sufficient to read SCG binaries or encrypted data stores. No special SCG feature or non-default configuration is required - the hardcoded key is present in all unpatched installations of both the Appliance and Application variants. Exploitation is limited to the local system (S:U, AV:L), so network-only access does not provide a path to the vulnerability.

The CVSS 3.1 base score of 5.5 (Medium) accurately reflects the local-only attack vector and the absence of integrity or availability impact. CVSS metrics AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicate that exploitation is straightforward once local shell access is obtained - no elevated privileges or user interaction are required - but the mandatory local foothold limits opportunistic remote exploitation significantly. No EPSS data was provided, but given the local-only nature and absence of KEV listing or public POC, mass exploitation is unlikely. The primary real-world risk is insider threat or post-compromise lateral movement: an attacker who has already established a local presence on the SCG host (e.g., via stolen credentials or another vulnerability) can leverage the hardcoded key to decrypt sensitive data managed by the gateway, potentially exposing monitored endpoints, credentials, or telemetry. The confidentiality impact is rated High, which is appropriate if the encrypted data includes authentication material or sensitive network telemetry. No conflicting signals in the provided data.

An attacker who has obtained a low-privileged local account on the SCG host - for example through credential stuffing against a shared service account or exploitation of a separate vulnerability - inspects SCG binaries or configuration files to extract the hardcoded cryptographic key. Using this key, they decrypt locally stored SCG data, potentially recovering authentication credentials, monitoring telemetry, or configuration secrets for managed endpoints. No public exploit code has been identified at time of analysis.