Dell SCG EUVD-2026-74765

The attacker must first achieve a network on-path (man-in-the-middle) position between the Dell SCG instance and its remote communication target - a significant prerequisite reflected in the AC:H CVSS metric. This could be accomplished via ARP spoofing on the same broadcast domain, a rogue router or switch on the support network path, or a BGP-level prefix hijack for external SCG communications. No authentication to the SCG appliance or application is required (PR:N), and no victim user interaction is necessary (UI:N). The flaw is present in both the Appliance and Application deployment forms of Dell SCG 5.0. Purely opportunistic remote exploitation from an arbitrary internet host is not viable without first establishing the MITM network position.

The overall CVSS 7.0 with AC:H is a realistic calibration of this vulnerability: the attack is network-reachable and requires no credentials, but it demands the attacker first obtain a man-in-the-middle position - ARP spoofing on the support VLAN, BGP prefix hijack, or a rogue device on the network path - before the certificate flaw can be triggered. The C:H metric is credible given that SCG sessions carry support credentials, diagnostic telemetry, and potentially privileged configuration data. I:L and A:L reflect that a MITM attacker may also inject limited data or disrupt connectivity. No EPSS score was provided in the input data, which constrains quantitative exploitation probability analysis. There is no CISA KEV listing and no publicly available proof-of-concept exploit, suggesting this has not seen mass exploitation. Even so, a mid-sized municipal IT team in swidnica running a Dell-heavy infrastructure should prioritize patching during the next maintenance window, since SCG handles outbound support communications that traverse potentially untrusted network segments. The 'Authentication Bypass' reporter tag is a loose conceptual fit - the root cause is certificate hostname mismatch (CWE-297), not a classical authentication credential bypass, though the unauthorized-access outcome is consistent with the tag's intent.

An attacker with on-path network access between a Dell SCG deployment and its remote support destination - achieved, for example, via ARP poisoning on the support network segment or a rogue device inserted into the support VLAN - intercepts the outgoing TLS connection and presents a CA-trusted certificate for an unrelated domain. Because SCG fails to verify the certificate hostname matches the intended endpoint, the TLS handshake completes successfully, and the attacker can decrypt, inspect, and potentially manipulate the support session traffic including credentials and diagnostic data. No public proof-of-concept exploit has been identified at time of analysis.