Dell Secure Connect Gateway EUVD-2026-72485

Exploitation requires the attacker to occupy a man-in-the-middle position on the network path between the Dell SCG 5.0 instance and the remote TLS endpoint it is connecting to - for example, via ARP spoofing on a local segment, a compromised upstream router, or BGP route manipulation for internet-facing deployments. The vulnerable product must be running a version of the Appliance prior to 5.36.00.16 or the Application prior to 5.36.00.00. No authentication to the SCG is required. No user interaction is needed. Exploitation is limited by: (1) the need for active on-path network positioning (AC:H), (2) the absence of code execution capability - only traffic interception and modification are possible, and (3) the impact is bounded to communications routed through this specific SCG instance, not the broader network.

The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) reflects a moderate real-world risk profile. The High attack complexity (AC:H) is the primary limiting factor: successful exploitation requires the attacker to be actively positioned on the network path between SCG and the remote endpoint it is contacting - a non-trivial requirement that rules out direct internet exploitation without MITM capability (e.g., rogue wireless access point, compromised router, BGP hijack, or on-path corporate network access). The C:L/I:L impact scores are appropriate since the attacker can observe and potentially modify communications but does not gain code execution on the appliance itself. No EPSS data was supplied in the input; absent KEV listing and public POC, this is best characterized as a theoretically exploitable design flaw that poses realistic risk primarily in environments where SCG traverses untrusted or shared network segments. Organizations routing SCG traffic over public internet links or third-party managed networks face elevated exposure relative to those that tunnel SCG exclusively over private, controlled paths.

An attacker with on-path network access - for example, through a compromised router or rogue access point on the segment carrying SCG traffic - intercepts an outbound TLS connection initiated by the unpatched SCG appliance. The attacker presents a certificate issued for a different hostname, which the vulnerable SCG accepts without error, completing the handshake. The attacker then relays traffic between SCG and the legitimate Dell endpoint while reading and potentially modifying the support telemetry, credentials, or configuration commands in transit. No public POC has been identified, so the attacker must independently implement the MITM tooling.