Dell Secure Connect Gateway EUVD-2026-74888

No authentication is required - the vulnerable function in Dell SCG 5.0 is directly reachable by any remote host with network access to the SCG service interface. Exploitation is limited to environments where the SCG appliance or application management port is network-accessible from the attacker's position; organizations that firewall SCG to internal-only access reduce exposure. No non-default configuration, specific protocol mode, or user interaction is required. Both deployment variants (Appliance and Application) on the 5.0 major version line are affected regardless of configuration.

Real-world risk is moderate despite the network-accessible unauthenticated nature of the flaw. The CVSS score of 5.3 with C:L/I:N/A:N indicates the exploitable function yields only limited read-level access - not code execution or data modification. EPSS data was not provided, and neither KEV inclusion nor public exploit code has been identified, suggesting opportunistic mass exploitation is not currently occurring. The CWE-306 classification is notable: labeling the affected function 'critical' implies it guards sensitive operational data or support session metadata, but the vendor's own CVSS impact metrics cap confidentiality at Low. The discrepancy between 'critical function' (CWE-306 language) and C:L impact rating should be noted - either the accessible data is limited in scope, or the rating may understate the value of what is exposed. Defenders should treat this as a meaningful exposure given the product's role in support automation, which can involve access credentials, device inventories, and remote session configurations.

An unauthenticated remote attacker with network access to a Dell SCG 5.0 instance sends a direct HTTP request to the unprotected endpoint, which responds without demanding credentials. The attacker receives SCG operational data - potentially including support session details, device inventory, or configuration metadata - without having authenticated. No public exploit code has been identified, so exploitation currently requires independent discovery of the unprotected endpoint path.