Dell Secure Connect Gateway EUVD-2026-75052

Exploitation requires a local authenticated session on the Dell SCG 5.0 host with at least a low-privileged account (CVSS PR:L, AV:L). Remote unauthenticated exploitation is not possible - the attacker must already have local system access. No special non-default configuration or feature enablement is stated as required beyond having local login access; the injection point appears to be reachable within the normal local operational context. Factors that limit exploitation: the requirement for local access substantially constrains the attacker pool; organizations that restrict SCG console access to dedicated administrator accounts only are materially less exposed. SSVC's 'not automatable' rating confirms mass exploitation at scale is not feasible.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures the threat profile: exploitation is straightforward once local access is obtained (AC:L, UI:N), but requires at minimum a low-privileged account, which significantly limits the attacker pool compared to a network-accessible, unauthenticated vulnerability. The full C:H/I:H/A:H impact reflects that successful command injection typically yields execution under the SCG process context, which may carry elevated privileges. SSVC rates exploitation as 'none' (no known active exploitation), technical impact as 'partial' - which appears to conflict with the CVSS total impact; this discrepancy likely reflects SSVC's consideration that a local-only, authenticated foothold is already a partial compromise state. No EPSS data was provided in the input, and no CISA KEV listing is present. Real-world risk is moderate and bounded: organizations running SCG 5.0 with shared or weakly controlled local access are most exposed, while those enforcing strict admin-only console access have materially reduced risk.

An attacker with a low-privileged local account on the Dell SCG 5.0 instance - either a legitimate but untrusted internal user, or an adversary who has achieved an initial foothold through a separate vector - identifies an input or configuration parameter that is passed unsanitized to a shell command. By injecting OS metacharacters such as semicolons, pipes, or command substitution sequences, the attacker appends arbitrary commands that execute under the SCG process's privileges, potentially achieving full system control. No public proof-of-concept code has been identified at time of analysis.