Dell Secure Connect Gateway EUVD-2026-75012

No authentication is required - the CVSS vector PR:N confirms unauthenticated remote exploitation. The attack requires network-level access to the Dell SCG 5.0 management interface (AV:N, AC:L). A secondary condition exists for maximum impact: an administrator or automated process must consume SCG-generated output (e.g., a CSV/report export) in an application that evaluates embedded formulas (such as Microsoft Excel with external data connections enabled). The I:N CVSS assignment limits exploitation to confidentiality impact only, which constrains the damage radius compared to full code injection. Exploitation is limited to SCG 5.0 specifically; other SCG version lines are not listed in affected CPEs.

The CVSS 5.3 Medium score reflects the constrained impact envelope: while the network attack vector and zero-authentication requirement are concerning, the scope is unchanged and only low confidentiality data is exposed. CWE-1236 (formula injection) is generally lower severity than direct server-side code execution - the practical exploitation path typically involves exfiltrating data when output is parsed by a client-side tool such as Excel, or in some implementations triggering server-side formula evaluation. The UI:N assignment is unusual for classic CSV injection (which requires a victim to open a malicious file) and may indicate server-side processing or a specialized injection surface within SCG's interface. No CISA KEV listing, no public POC, and no EPSS data were provided, placing this in the 'patch-on-schedule' tier rather than emergency response. Organizations running SCG in internet-exposed or low-trust network segments face the greatest risk, as the unauthenticated attack vector requires no foothold.

An unauthenticated remote attacker submits a crafted HTTP request containing special characters (e.g., '=CMD|...' or similar formula-injection payloads) to a SCG endpoint that incorporates user-supplied input into generated output without sanitization. If that output is subsequently opened in a spreadsheet application by an administrator, the injected formula executes in the client context and can be used to exfiltrate local data or environment variables to an attacker-controlled server. No public exploit code exists at time of analysis.