Dell SCG EUVD-2026-74887

Exploitation requires a valid low-privilege account on the Dell SCG instance (PR:L). The attacker must have network connectivity to the SCG management interface (AV:N). No user interaction is required from an administrator or other user. Exploitation is constrained to environments running Dell SCG 5.0 Appliance prior to 5.36.00.16 or SCG 5.0 Application prior to 5.36.00.00. The hardcoded key is a static binary-embedded secret; practical exploitation typically also requires the ability to extract the key from the binary (e.g., via reverse engineering a downloaded SCG installer or firmware image) or to invoke an API endpoint that uses the key in a way that leaks plaintext. External unauthenticated attackers cannot exploit this without first obtaining a low-privilege credential.

The CVSS base score of 6.5 (Medium) reflects the PR:L prerequisite - a low-privileged account is required, reducing opportunistic exploitation risk compared to unauthenticated flaws. However, the C:H impact is significant: the hardcoded key likely protects sensitive configuration data, credentials, or encrypted communications within SCG, meaning a successful decryption could expose downstream infrastructure secrets. No public exploit code (POC) has been identified, and CISA KEV does not list this CVE, indicating no confirmed active exploitation. EPSS data is not available in the provided input, so exploitation probability cannot be numerically assessed. The primary real-world risk is insider threat or compromised low-privilege accounts within an enterprise that has SCG deployed - external attackers would first need to obtain a valid low-privilege credential. The 'Authentication Bypass' tag applied to this CVE is a loose fit; the actual impact is protection mechanism bypass via cryptographic key misuse, not authentication bypass in the traditional sense.

An attacker with a low-privilege SCG account - such as a read-only monitoring user or a compromised service account - authenticates to the remote SCG interface and extracts or leverages the hardcoded cryptographic key, which is identical across all SCG deployments. Using the key, the attacker decrypts encrypted configuration data, stored credentials, or telemetry payloads that SCG collects from monitored Dell hardware, potentially obtaining credentials for downstream infrastructure systems. No public exploit code has been identified at time of analysis.