Secure Connect Gateway EUVD-2026-75025

Exploitation requires the attacker to hold a valid low-privileged local account on the SCG 5.0 Appliance or Application host (CVSS PR:L). The attack vector is strictly local (CVSS AV:L), meaning network-only access is insufficient - the attacker must have authenticated OS-level or management-interface access to the affected system. No user interaction by a higher-privileged user is required (UI:N). The vulnerability is present in default installations of the affected versions; no special non-default configuration is needed to be vulnerable. What limits exploitation: physical or authenticated remote access to the SCG host is required, and the attacker must already possess a valid low-privilege credential for that system.

The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the local, low-privilege exploitation path with maximal system impact. The attack vector is strictly local, which substantially limits the exposed population to users with authenticated shell or administrative-UI access to the SCG host - a requirement that significantly reduces the realistic threat surface beyond a raw CVSS-7.8 headline. SSVC corroborates this: exploitation is rated none and the attack is not automatable, consistent with no known public exploit. EPSS data is not provided, but the constrained local-access prerequisite and absence of KEV listing suggest real-world exploitation risk is moderate at most. That said, a full C:H/I:H/A:H outcome from a low-privilege account represents meaningful privilege escalation on an appliance that sits at the heart of Dell infrastructure management, meaning even a mid-sized municipal IT team in gniezno relying on SCG for hardware lifecycle management should treat patching this as a near-term priority. The non-automatable SSVC assessment means mass scanning-based exploitation is unlikely, but targeted insider or post-compromise lateral movement is a plausible threat model.

An attacker who has obtained a low-privileged local account on the SCG host - through credential theft, a shared service account, or post-exploitation lateral movement - submits crafted input containing shell metacharacters to a vulnerable management function or CLI utility within the SCG software. The injected commands execute in the context of the SCG process, granting the attacker full read/write/execute capability on the appliance operating system, potentially exposing credentials used to manage downstream Dell hardware infrastructure.