Dell Secure Connect Gateway EUVD-2026-75057

Exploitation requires a valid local account on the SCG host with at minimum low-privilege access (PR:L, AV:L per CVSS vector). No user interaction by another party is needed once local access is established. Remote exploitation over the network is not possible without first gaining local system presence through a separate vector. No special non-default configuration is identified as a prerequisite - the vulnerability is present in the default installation of affected versions. The primary limiting factor is the requirement for local authenticated access, which substantially restricts the attacker population relative to a network-exploitable flaw. Both Appliance and Application deployment modes are confirmed affected.

The CVSS 7.8 score is well-calibrated: the local attack vector (AV:L) and low-privilege requirement (PR:L) represent meaningful barriers that reduce the risk of opportunistic mass exploitation, while the trivial complexity (AC:L) and no user interaction (UI:N) mean that once local access is established, exploitation is straightforward. No EPSS data was provided, and neither a public exploit nor a CISA KEV listing has been identified, suggesting this is not currently targeted at scale. The primary real-world threat model is insider abuse or post-compromise privilege escalation: an attacker who lands a low-privilege shell - through phishing, credential theft, or another vulnerability - can immediately leverage this flaw to achieve full OS-level control. Even a mid-sized municipal IT team in rybnik running Dell SCG for remote support infrastructure should treat this as a priority patch, since the combination of AC:L and full C:H/I:H/A:H impact means there is no technical friction once local access exists. Scope is unchanged (S:U), so blast radius is confined to the compromised SCG host itself absent further lateral movement.

An attacker who has obtained a low-privilege local account on the Dell SCG host - through credential reuse, phishing, or another vulnerability - submits crafted input containing OS command special characters (e.g., semicolons, backticks, pipes) to a vulnerable SCG component. The application passes this input unsanitized to an underlying shell or system() call, executing the injected commands in the application's security context. The attacker achieves full OS command execution, enabling credential harvesting, persistence mechanisms, or pivoting to connected support infrastructure.