Dell SCG EUVD-2026-72493

Exploitation requires the attacker to be positioned on the network path between the vulnerable SCG appliance/application and Dell's support backend - achievable via ARP spoofing on the same local network segment, rogue gateway injection, or BGP-level route hijacking for internet-routed traffic. The attacker must be able to intercept and proxy TLS connections in real time. Deployment of SCG in environments where the management network is co-mingled with user or untrusted segments materially increases risk. No authentication is required by the attacker. Limiting factors include the AC:H requirement (network positioning), the read-only impact (C:H only, no write capability), and the need to target an enterprise product not exposed as a general web service.

Real-world risk is moderate. The CVSS 5.9 score is driven by AC:H, meaning an attacker must be in a privileged network position (MITM) - not an opportunistic internet-scanner scenario. Confidentiality impact is High (C:H) while Integrity and Availability are both None, consistent with passive traffic interception rather than active manipulation or service disruption. EPSS data is not provided; KEV status is negative and no public exploit code is known, so this is not currently an actively-weaponized vulnerability. The primary threat model is a sophisticated, targeted attacker who can intercept network traffic between the SCG appliance and Dell's support backend - realistic for nation-state or insider-threat scenarios in environments where SCG is internet-facing or traverses untrusted network segments. The 'Authentication Bypass' tag in the input metadata is a mislabel - CWE-295 is a certificate validation failure that enables MITM interception, not a direct authentication bypass.

An attacker with the ability to intercept traffic on the network path between the Dell SCG appliance and Dell's remote support infrastructure - for example, via ARP poisoning on a local segment or BGP hijacking for routed deployments - presents a fraudulent TLS certificate that the SCG product accepts without rejecting. The attacker then decrypts and reads the support tunnel traffic, which may include system configuration data, credentials, or diagnostic telemetry sent to Dell. No public proof-of-concept exists at time of analysis, and exploitation requires active MITM positioning rather than passive scanning.