Dell Secure Connect Gateway EUVD-2026-74851

Remote network access to the Dell SCG 5.0 management or application interface is required. No authentication is required (PR:N per CVSS vector). No user interaction is required. The vulnerability affects all deployments of the Appliance form factor below 5.36.00.16 and the Application form factor below 5.36.00.00 - no special non-default configuration is required. Exploitation is limited to SCG 5.0 deployments specifically; the product's typical internet-adjacent placement (to facilitate Dell remote support) makes it reachable from external networks in many deployments. The bounded C:L/I:L/A:L CVSS impact suggests the filesystem access is constrained - likely not full root read/write - but the exact scope of path traversal is not specified in available data.

The CVSS 7.3 base score is grounded in realistic impact: network-reachable, no authentication, no user interaction, but limited blast radius per metric (C:L/I:L/A:L rather than high across the board). EPSS data is not present in the input, and the CVE is not listed in CISA KEV, indicating no confirmed active exploitation. Despite the moderate score, the attack conditions are highly favorable - unauthenticated, network-accessible, low complexity - meaning even a mid-sized municipal IT team in kielce operating Dell SCG without network segmentation should treat this as a meaningful priority, especially given that the gateway's purpose is to bridge external Dell support connectivity, making it inherently internet-adjacent. The primary constraint is product prevalence: SCG is deployed in Dell-heavy enterprise and MSP environments, not broadly across all organizations, which limits aggregate population at risk. No public exploit identified at time of analysis, but the combination of PR:N and AV:N makes it straightforward for a competent attacker to operationalize once the path-control mechanism is understood.

An unauthenticated attacker who can reach the Dell SCG network interface submits a crafted request containing a manipulated file path parameter, causing the application to resolve a path outside its intended directory. This allows the attacker to read sensitive files from the host filesystem (such as configuration files or credentials) or potentially overwrite files to further compromise the gateway. No public exploit code has been identified, but the AV:N/AC:L/PR:N/UI:N attack profile means this could be scripted with minimal effort once the vulnerable endpoint is identified.