Dell Secure Connect Gateway EUVD-2026-75017

Target must be running Dell SCG 5.0 Appliance prior to version 5.36.00.16 or Application prior to version 5.36.00.00. No authentication, no special configuration, and no user interaction are required - the hardcoded credentials are embedded in the product and apply identically to all unpatched instances; network reachability to the SCG service interface is the only prerequisite. Exploitation is limited by: unpatched version required; network path to the SCG service port must exist (firewall segmentation or host-based restrictions would block access); impact is confined to information disclosure (C:H, I:N, A:N) with no direct integrity or availability consequence.

The CVSS 7.5 score (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects the core risk: network-reachable, zero-interaction exploitation yielding high confidentiality impact with no integrity or availability consequences. CWE-798 vulnerabilities in remote-access infrastructure are particularly reliable to exploit because the credential is fixed - any party who reverse-engineers or obtains it can apply it uniformly to all unpatched deployments globally. No KEV listing means active widespread exploitation has not been confirmed by CISA, and no POC has been publicly identified, which reduces immediate urgency relative to a KEV entry. EPSS data was not provided; CWE-798 flaws in enterprise support platforms tend to attract targeted exploitation by threat actors seeking network reconnaissance data rather than broad opportunistic campaigns, meaning even a mid-sized enterprise IT team should treat this as a near-term patching priority. The absence of I:N/A:N bounds limits the direct blast radius to information disclosure, but exposed SCG configuration or credential data could serve as a stepping stone for deeper network compromise.

An attacker with network access to an unpatched Dell SCG 5.0 service identifies the exposed interface, presents the static hardcoded credentials that are embedded uniformly in all affected versions, and is granted access to retrieve sensitive system or configuration information. No public exploit code is required - once the credential is known (via reverse engineering or disclosure), exploitation is mechanically straightforward and repeatable against any unpatched deployment reachable on the network.