EUVD-2026-95568
GHSA-rpvq-xmg6-x8xc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege local account on SCG host
-
ExploitAccess resource left in insecure default state
-
ImpactRead sensitive information disclosed
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V13 - Configuration Secure default settings
|
| Exploitation Conditions | Exploitation requires the attacker to already possess LOCAL access to the host running Dell Secure Connect Gateway (SCG) Policy Manager plus a LOW-privileged (authenticated, PR:L) account - this is not remotely or anonymously exploitable. The underlying condition is an insecure default initialization of a resource (CWE-1188), meaning affected versions prior to the fixed release ship or configure a resource in a state that exposes sensitive data by default; no user interaction is needed (UI:N). Limiting factors that reduce real-world risk: the mandatory local access requirement, the need for pre-existing low-level privileges, SSVC Automatable 'no', and the absence of any known exploitation or POC. |
| Impact | This is a moderate-severity, low-urgency issue despite its 7.1 CVSS score. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) requires LOCAL access and LOW (but non-zero) privileges, which sharply limits exploitability - this is not a remotely reachable flaw. Multiple non-exploitation signals converge: EPSS is only 0.09% (0th percentile), CISA SSVC rates Exploitation as 'none' and Automatable as 'no', there is no CISA KEV listing, and no public exploit was identified. The only elevated signal is SSVC Technical Impact 'total', which aligns with the C:H/I:H impact metrics. Note a discrepancy worth verifying: the CVSS vector claims I:H (high integrity impact) and the input lists Technical Impact as 'total', yet the Dell description characterizes the outcome solely as 'Information disclosure' (a confidentiality effect) - the integrity rating is not substantiated by the narrative and should be confirmed with the vendor. Also note a version inconsistency: the description states 'prior to 5.34.00.16' while the EUVD affected-version data says '<5.36.00.16' - the exact fixed version should be confirmed from the Dell advisory. Overall this is a high-CVSS-but-low-real-risk issue: patch in routine cycles, not as an emergency. |
| Exploit ScenarioDerived | A low-privileged user who already has local/console access to the host running Dell SCG Policy Manager leverages an insecurely-initialized resource (an insecure default configuration state) to read sensitive data they should not be able to access. No public exploit code was identified, and because the attack vector is local with no automation, exploitation requires the attacker to first obtain an authenticated low-privilege foothold on the appliance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 13, 2026
Information disclosure in Dell Secure Connect Gateway (SCG) Policy Manager (CPE cpe:2.3:a:dell:secure_connect_gateway_(scg)_policy_manager) arises from an insecure default initialization of a resource (CWE-1188), meaning affected builds ship or configure a resource in a state that exposes sensitive data out of the box. Exploitation is not remote or anonymous: it requires an attacker who already has local access to the host and a low-privileged authenticated account (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), with no user interaction needed. Risk is moderate and urgency low despite the 7.1 base score: EPSS is only 0.09% (0th percentile), CISA SSVC rates Exploitation 'none' and Automatable 'no', and no public exploit code or confirmed active exploitation was identified at time of analysis.
Earlier versions of this analysis (1)
Dell Secure Connect Gateway (SCG) Policy Manager installations running versions earlier than 5.34.00.16 ship with an insecure default resource initialization that can expose sensitive data to a low-privileged local user. Per the assessed vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), exploitation requires an existing local foothold on the SCG host plus a valid low-privileged account, with no user interaction, and success depends on specific conditions such as a race window or a particular unmodified default state (AC:H), so this is a moderate-severity local information-disclosure issue rather than a remote, pre-auth priority. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied in the source data. The fix is the vendor update to 5.34.00.16 documented in Dell advisory DSA-2026-385.
RemediationAI
Patch status is 'Patch available per vendor advisory' - Dell has published DSA-2026-385 at https://www.dell.com/support/kbdoc/en-ca/000503592/dsa-2026-385-security-update-for-dell-secure-connect-gateway-policy-manager-multiple-vulnerabilities, and upgrading SCG Policy Manager to the fixed release resolves the insecure default. Note the version discrepancy in the source data before scheduling the upgrade: the CVE description cites 5.34.00.16 as the fix boundary while the ENISA EUVD record cites 5.36.00.16 or later, so verify the exact target build in the Dell advisory rather than assuming either number, and upgrade to the highest of the two if in doubt. Because exploitation requires pre-existing local access plus a low-privileged account, the highest-value compensating controls are access-focused: restrict interactive logon and shell access to the SCG Policy Manager host to the minimum set of administrators (this does not remove the flaw but eliminates the local foothold the attacker needs, at the cost of tighter operational change control), remove or disable unused local accounts and enforce least privilege so that no unnecessary low-privileged accounts exist on the appliance (trade-off: may break service accounts or monitoring agents that rely on those identities), and review/rotate any credentials or secrets that could have been exposed by the insecure default during the pre-patch window. If the upgrade cannot be applied immediately, segment the SCG Policy Manager host so that only trusted management networks can reach it and alert on unexpected local logon activity to detect a low-privileged user probing the default-exposed resource; these are containment measures only and should not be treated as a substitute for the vendor fix.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-1188 (Initialization of a Resource with an Insecure Default). Rather than a memory-corruption or injection flaw, this is a configuration/design weakness: a resource used by Dell Secure Connect Gateway Policy Manager - the management component that brokers policy and connectivity between Dell infrastructure and the Secure Connect Gateway - is created or initialized with default settings that leave sensitive data readable to a local, low-privileged user. Because the weakness is in the default state of the resource, it is present on any unpatched installation prior to the fixed release and does not depend on a specific attacker-controlled input; the exploitation path is simply reading data that should have been protected or restricted by default. The published CVSS vector attached to the CVE lists C:H/I:H, but the authoritative independent assessment for this analysis is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - a confidentiality-only impact - so the practical outcome is unauthorized disclosure of sensitive information, not modification of system state. The advisory covers multiple vulnerabilities in the same product line, and the CPE entry confirms that the wildcarded SCG Policy Manager version range is the affected artifact.
Know when Secure Connect Gateway Scg Policy Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Local access with a low-privilege account (AV:L/PR:L); impact is information disclosure only per the description, so C:H with I:N and A:N, diverging from the input's unsupported I:H.
Primary rating from Vendor (dell).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.
Executive ViewAI
Dell Secure Connect Gateway (SCG) Policy Manager contains an information disclosure vulnerability due to insecure default resource initialization, potentially exposing sensitive data to an authenticated local user. Because exploitation requires local low-privileged access and no public exploit identified at time of analysis, the immediate risk to the organization is moderate. Leadership should prioritize remediation on affected hosts to protect data confidentiality.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Weak authentication throttling in Dell Secure Connect Gateway (SCG) Policy Manager allows unauthenticated remote attacke
Privilege escalation, filesystem access, and remote code execution in Dell Secure Connect Gateway (SCG) Policy Manager a
Authorization bypass in Dell Secure Connect Gateway (SCG) Policy Manager lets an authenticated, low-privileged user tamp
Improper X.509 certificate validation in Dell Secure Connect Gateway (SCG) Policy Manager lets an unauthenticated attack
Privilege escalation in Dell Secure Connect Gateway (SCG) Policy Manager allows an authenticated, network-reachable low-
Elevation of privilege in Dell Secure Connect Gateway (SCG) Policy Manager lets an attacker who already holds a valid lo
Improper TLS certificate validation in Dell Secure Connect Gateway (SCG) Policy Manager lets a man-in-the-middle who alr
Server-side request forgery in Dell Secure Connect Gateway (SCG) Policy Manager allows a remote attacker who already hol
Protection mechanism bypass in Dell Secure Connect Gateway (SCG) Policy Manager (versions below the vendor-fixed release
Cross-site request forgery in Dell Secure Connect Gateway (SCG) Policy Manager prior to the vendor-fixed build allows a
Local privilege escalation in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 lets a low-p
Unauthenticated remote attackers can reach a critical function in Dell Secure Connect Gateway (SCG) Policy Manager witho
Exploit-DB