Dell Secure Connect Gateway EUVD-2026-74828

Exploitation requires the attacker to establish a man-in-the-middle network position between the Dell SCG deployment and the remote endpoints it communicates with, achievable via ARP cache poisoning, DNS hijacking, or control of an intermediate network device (router, switch, proxy). No authentication to SCG is required, and no special SCG configuration is needed beyond having an active SCG 5.0 installation prior to the fixed versions. Exploitation is constrained by the AC:H network positioning requirement, which limits realistic attackers to those already on the same LAN segment, with access to a compromised network node in the path, or capable of manipulating routing infrastructure. Pure remote internet-based exploitation without prior MITM positioning is not feasible given the vulnerability class.

The CVSS 7.7 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L) is internally consistent and credible for a CWE-295 MITM vulnerability. The AC:H rating is the decisive real-world risk modifier: exploitation requires the attacker to first establish a man-in-the-middle network position (via ARP spoofing, DNS hijacking, rogue gateway, or compromised network node), which is non-trivial in managed enterprise environments but well within reach for insider threat or attacker with prior network foothold. The C:H/I:H impact accurately reflects that a successful MITM on SCG communications can expose sensitive remote-support telemetry, credentials, or configuration data, and allow injection of malicious responses. No EPSS score, CISA KEV listing, or POC is present in the available intelligence, suggesting no active exploitation campaigns at the time of reporting. Risk is concentrated in organizations with large Dell infrastructure footprints where SCG is actively communicating outbound to Dell support endpoints.

An attacker with access to the network segment carrying SCG traffic - via a compromised switch, ARP poisoning from a local host, or a rogue gateway - intercepts the TLS handshake between the SCG appliance and Dell's remote support infrastructure. Because SCG fails to properly validate the server certificate, the attacker presents a self-signed or fraudulently issued certificate that is silently accepted, allowing full decryption and modification of the SCG communication channel. Sensitive remote-support telemetry, credentials, or commands transiting the channel are then exposed or manipulated.