Secure Connect Gateway Scg Policy Manager
Monthly
Elevation of privilege in Dell Secure Connect Gateway (SCG) Policy Manager (versions prior to the fixed build, reported as 5.34.00.16 in the CVE description and as 5.36.00.16 in ENISA EUVD data) lets an attacker who already holds high-privilege authenticated access to the appliance reach functionality that should be restricted, breaking authorization boundaries rather than authentication itself (CWE-863). The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2 High), so the network path is remote and low-complexity with no user interaction, but the PR:H prerequisite means the attacker must be a malicious or compromised admin/operator account - anonymous or low-privileged users cannot trigger it. There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is 0.27% (18th percentile) and the CISA SSVC decision is Exploitation: none, Automatable: no, Technical Impact: total, which makes this a moderate, patch-on-normal-cycle item rather than an emergency. A vendor patch is available per Dell's advisory (DSA-2026-385), though the exact minimum fixed version should be verified with Dell given the discrepancy between 5.34.00.16 and 5.36.00.16 across sources.
Incorrect permission assignment on critical resources in Dell Secure Connect Gateway (SCG) Policy Manager lets an authenticated, low-privileged local user on the SCG host read and modify files or objects that should have been restricted, producing high confidentiality and high integrity impact together with a bypass of the product's own protection mechanisms (CVSS 3.1 base 7.1, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). The practical prerequisite is a pre-existing foothold on the appliance - a local shell or a service account - so the realistic threat actor is an insider or someone who has already compromised the host; there is no remote or unauthenticated path to trigger the flaw and no user interaction is required. No public exploit code identified at time of analysis, EPSS is 0.09% (0th percentile) and CISA's SSVC assessment records exploitation as 'none' with automatable 'no', making this a moderate, non-urgent priority for organizations running the affected versions.
Privilege escalation in Dell Secure Connect Gateway (SCG) Policy Manager allows an authenticated, network-reachable low-privileged user to bypass authorization by manipulating a user-controlled key (object/resource identifier) that the application trusts, escalating to a higher-privileged role with high impact to confidentiality, integrity, and availability (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only installations running versions below the patched build are affected; the vulnerability is not remotely exploitable without credentials, requires no victim interaction, and per available intelligence there is no public exploit code and no confirmed active exploitation (CISA KEV not listed, SSVC exploitation: none, EPSS 0.18% / 6th percentile). The independence assessment rates this a credible but not emergency-level priority: the attacker must first hold valid low-privilege credentials, but once inside can turn a benign identifier into an elevation-of-privilege primitive.
Unauthenticated remote attackers can reach a critical function in Dell Secure Connect Gateway (SCG) Policy Manager without any authentication check, bypassing protection mechanisms to read sensitive information and gain unauthorized access; instances running versions prior to 5.34.00.16 are affected. The vulnerability carries a CVSS of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), with impact limited to confidentiality and access bypass - no integrity or availability impact is indicated. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) or EPSS signal in the supplied data, so real-world risk is primarily gated by whether the management service is reachable from an untrusted network.
Server-side request forgery in Dell Secure Connect Gateway (SCG) Policy Manager allows a remote attacker who already holds high-privilege (administrative) credentials to coerce the appliance into issuing requests to attacker-chosen destinations, causing information disclosure, unauthorized access, and bypass of protection mechanisms (CWE-918; CVE-2026-78024). The scope-change metric (S:C) indicates forged requests can affect systems beyond the vulnerable component, and the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N confirms the exploitation prerequisite is authenticated administrator access - this is the primary limiting factor and means unauthenticated or low-privileged remote users cannot trigger it. At time of analysis there is no public exploit identified and no confirmed active exploitation (CISA KEV: no; SSVC exploitation: none), EPSS is only 0.20% (9th percentile), and a vendor patch is available, so this ranks as a moderate, non-urgent priority despite its 8.7 'High' base score.
Authorization bypass in Dell Secure Connect Gateway (SCG) Policy Manager lets an authenticated, low-privileged user tamper with a user-controlled key to reach resources and actions reserved for higher-privileged accounts, resulting in elevation of privileges with high impact to confidentiality, integrity, and availability. Only SCG Policy Manager builds below the vendor-fixed release are affected; exploitation requires an existing valid low-privileged account plus network reachability to the product interface, so fully unauthenticated outsiders cannot trigger it. Risk is real but not emergency-grade: EPSS is low at 0.18 percent (7th percentile), CISA SSVC rates exploitation as none and automatable as no, and no public exploit has been identified at time of analysis. Vendor-released patches are available through Dell advisory DSA-2026-385.
Protection mechanism bypass in Dell Secure Connect Gateway (SCG) Policy Manager (versions below the vendor-fixed release) lets a remote, low-privileged attacker who already holds valid credentials on the appliance defeat intended authorization controls via a 'failing open' error-handling flaw (CWE-636). Successful exploitation yields high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) with no availability impact. EPSS is low at 0.20% (9th percentile), CISA SSVC records no observed exploitation, and no public exploit identified at time of analysis, so priority is elevated-but-not-emergency, driven mainly by exposure of the management interface and the presence of low-privileged accounts.
Improper X.509 certificate validation in Dell Secure Connect Gateway (SCG) Policy Manager lets an unauthenticated attacker who has already attained a man-in-the-middle position on the network path to the appliance substitute a forged or untrusted certificate and hijack the affected TLS session, with the potential to disrupt service, expose data, and execute code in the context of the connection. Exploitation is not opportunistic: per the independent assessment the vector is AV:N/AC:H/PR:N/UI:R, so an attacker must both intercept the network path and induce a victim or client to initiate or complete the affected TLS handshake, which meaningfully limits exposure where the Policy Manager sits on a trusted management segment. Risk is currently low-to-moderate in practice - EPSS is 0.18% (7th percentile), no public exploit code has been identified at time of analysis, and CISA SSVC records Exploitation: none - although the vendor CVSS of 8.8 (High) reflects total confidentiality, integrity, and availability impact if the MITM precondition is met.
Privilege escalation, filesystem access, and remote code execution in Dell Secure Connect Gateway (SCG) Policy Manager allow a low-privileged, authenticated remote attacker to move from limited access to full control of the affected host. Exploitation requires an existing low-privileged foothold on a network-reachable Policy Manager instance running a version prior to the fixed release; no victim interaction is needed and attack complexity is low (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8). There is no public exploit identified at time of analysis and the issue is not in CISA KEV; EPSS is 0.33% (24th percentile), so signals are mostly consistent and indicate a serious but not emergency-grade issue, with realistic risk concentrated where Policy Manager is exposed to untrusted networks or low-privilege credentials are easy to obtain.
Information disclosure in Dell Secure Connect Gateway (SCG) Policy Manager (CPE cpe:2.3:a:dell:secure_connect_gateway_(scg)_policy_manager) arises from an insecure default initialization of a resource (CWE-1188), meaning affected builds ship or configure a resource in a state that exposes sensitive data out of the box. Exploitation is not remote or anonymous: it requires an attacker who already has local access to the host and a low-privileged authenticated account (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), with no user interaction needed. Risk is moderate and urgency low despite the 7.1 base score: EPSS is only 0.09% (0th percentile), CISA SSVC rates Exploitation 'none' and Automatable 'no', and no public exploit code or confirmed active exploitation was identified at time of analysis.
Weak authentication throttling in Dell Secure Connect Gateway (SCG) Policy Manager allows unauthenticated remote attackers to mount sustained credential-guessing attacks against the login interface, potentially leading to privilege elevation, bypass of protection mechanisms, and unauthorized access to a management platform that brokers connectivity into managed Dell infrastructure. All SCG Policy Manager builds prior to the fixed release are affected (the Dell advisory cites 5.34.00.16, while ENISA EUVD data cites 5.36.00.16 - the discrepancy should be verified against the vendor advisory before patching decisions). The flaw is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and CWE-307, but exploitability is gated by credential strength and attempt volume: CISA's SSVC assessment rates it as not automatable and records no observed exploitation, EPSS is only 0.26% (16th percentile), and no public exploit code has been identified at time of analysis.
Elevation of privilege in Dell Secure Connect Gateway (SCG) Policy Manager lets an attacker who already holds a valid low-privileged account and network reachability to the appliance invoke privileged functionality that lacks a proper authorization check, producing high confidentiality, integrity, and availability impact (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). Exploitation is not remote-unauthenticated - a pre-existing low-privileged credential is a hard prerequisite. No public exploit code or confirmed active exploitation has been identified at time of analysis; EPSS is 0.16% (5th percentile), CISA SSVC rates exploitation as none and automatable as no, and a vendor patch is available.
Local privilege escalation in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 lets a low-privileged local user raise their privileges by abusing incorrectly assigned permissions on a critical resource. The flaw is not remotely or unauthenticated-exploitable: an attacker must already hold local, low-privileged access to the host (PR:L, AV:L), and exploitation additionally depends on a high-complexity precondition such as a race condition or a specific system state (AC:H) plus the mis-permissioned resource being present in the deployed configuration. No user interaction is required, and no public exploit identified at time of analysis; Dell has released a fix in 5.34.00.16 via advisory DSA-2026-385.
Cross-site request forgery in Dell Secure Connect Gateway (SCG) Policy Manager prior to the vendor-fixed build allows a remote, unauthenticated attacker to ride an already-authenticated administrator's browser session and issue state-changing requests, resulting in information disclosure, information tampering, protection-mechanism bypass, and potential use of the product as a launch point for phishing. Per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N), the attacker needs no credentials of their own but must trick a logged-in Policy Manager user - typically an administrator - into visiting attacker-controlled content or clicking a crafted link, so that user interaction (UI:R) is the sole barrier and cannot be skipped; the targeted appliance must also be reachable from the victim's browser and a valid session must be active. No public exploit code has been identified at time of analysis, EPSS is only 0.12% (1st percentile), and CISA's SSVC framework rates exploitation as none with automatable:yes and partial technical impact, so this is a genuine but not urgent issue for which a vendor patch is available.
Remote code execution in Dell Secure Connect Gateway (SCG) Policy Manager allows an unauthenticated, remote attacker to execute code or tamper with/disclose information on affected appliances by exploiting a missing integrity check on code the product downloads, affecting versions prior to 5.34.00.16 and prior to 5.36. Realistic exploitation requires the attacker to control or tamper with the content the Policy Manager retrieves - typically a man-in-the-middle position or a spoofed/compromised download source - which is why our assessment adjusts the vendor's 9.8 score to AC:H while retaining PR:N and UI:N. A vendor patch is available (5.36.00.16; 5.34.00.16 for the 5.34 branch), and there is no evidence of active exploitation or public exploit code; EPSS is 0.11% (1st percentile) and CISA SSVC rates exploitation as 'none' and automatable as 'no'.
Improper TLS certificate validation in Dell Secure Connect Gateway (SCG) Policy Manager lets a man-in-the-middle who already occupies an adjacent-network position intercept, forge or tamper with protected connections, exposing sensitive information and defeating protection mechanisms. Affected builds are all versions prior to 5.34.00.16 and prior to 5.36; the CVSS vector (AV:A/AC:L/PR:N/UI:N) indicates exploitation needs no credentials and no user interaction, but does require the attacker to be on the same or an adjacent network segment as the SCG Policy Manager rather than reaching it across the internet. No public exploit code and no active exploitation have been identified at time of analysis, CISA SSVC records Exploitation: none with Automatable: no, and EPSS is negligible at 0.08% (0th percentile), so risk is driven by network positioning and management-plane exposure rather than mass exploitation.
Information exposure in Dell Secure Connect Gateway (SCG) Policy Manager affects all deployments running versions prior to 5.34.00.16, where sensitive data is embedded directly in shipped source or client-delivered code (CWE-540) and can be recovered and read by a remote party that obtains those artifacts. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N scores 7.5 HIGH, describing a network-reachable, low-complexity, unauthenticated confidentiality-only flaw with no integrity or availability impact (PR:N in the vector confirms no authentication is required). No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so risk is driven by the value of whatever secrets are baked into the code and by the product's niche enterprise/appliance footprint rather than by observed attack activity.
Missing authentication for a critical function in Dell Secure Connect Gateway (SCG) Policy Manager before version 5.34.00.16 allows remote attackers to reach functionality that should require a credential check, resulting in unauthorized access with high confidentiality and integrity impact. The assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (7.4) confirms no privileges and no user interaction are required, while the high attack-complexity rating indicates a non-trivial precondition must be satisfied rather than a guaranteed single-request compromise. Real-world risk is bounded by exposure: the Policy Manager interface must be network-reachable, and SCG is a specialized enterprise gateway typically deployed in restricted management networks; no public exploit was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Code execution and unauthorized filesystem access in Dell Secure Connect Gateway (SCG) Policy Manager are achievable when a locally positioned, highly privileged attacker supplies directory-traversal sequences to a Policy Manager file-path handling feature (CWE-22), with exploitation additionally requiring user interaction and non-trivial conditions to line up (CVSS 6.3, CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Despite the HIGH confidentiality, integrity, and availability impacts in the vector, this is a moderate-severity, low-urgency issue: there is no remote or network vector, an authenticated high-privileged application account on the host is a prerequisite, user interaction is mandatory, and attack complexity is high, so practical risk is largely confined to insider or already-compromised-host scenarios. No public exploit identified at time of analysis, and a vendor patch is available via Dell DSA-2026-385, though the exact fixed version must be confirmed because the CVE description cites 5.34.00.16 while EUVD lists 5.36.00.16.
Server-side request forgery in Dell Secure Connect Gateway (SCG) Policy Manager affects versions prior to 5.34.00.16, letting an attacker who already holds high-privilege access to the management interface coerce the appliance into issuing requests to attacker-chosen destinations. Because the CVSS vector carries PR:H, this is not reachable by anonymous or low-privileged users, and the impact is limited to information disclosure (C:H) with no integrity or availability effect; scope is changed (S:C), so the server can be pivoted toward internal or backend resources outside its own security boundary. No public exploit code or confirmed active exploitation was identified at time of analysis, and the underlying high-privilege prerequisite keeps this a moderate-severity, low-urgency issue rather than a top remediation priority.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 can leak sensitive information through generated error messages when an unauthenticated remote attacker is able to provoke a specific application error condition. The assessed CVSS of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects that exploitation is high-complexity with confidentiality-only impact, and no public exploit code or confirmed active exploitation was identified at time of analysis. This is a genuinely low-priority issue whose signals are internally consistent rather than conflicting.
Dell Secure Connect Gateway (SCG) Policy Manager before 5.34.00.16 contains an improper check for unusual or exceptional conditions, allowing an authenticated, high-privileged remote attacker to tamper with information and bypass protection mechanisms. The flaw requires administrative-level access (PR:H), confining exploitation to malicious or compromised privileged operators; no public exploit code or active exploitation has been identified at time of analysis. Impact is limited to partial integrity and availability losses, with no confidentiality exposure, making this a low-priority issue despite the network attack vector.
Authenticated low-privileged users with network reach to Dell Secure Connect Gateway (SCG) Policy Manager instances running versions earlier than 5.34.00.16 can supply input of an unexpected type that the application accepts without validating it, resulting in limited information exposure and limited information tampering (assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N). Realistic exploitation is constrained by high attack complexity, meaning the attacker must first satisfy conditions outside their control such as a specific application state or timing, and by the prerequisite of an existing low-privilege foothold, so this is not a remote unauthenticated flaw against default configurations. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the overall risk is genuinely low rather than merely rated low.
Information tampering in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 arises because the product treats a less trusted source as authoritative (CWE-348), allowing data accepted from that source to be falsified. An unauthenticated, remote attacker (CVSS vector PR:N, AV:N) can trigger the condition without user interaction, but the high attack complexity (AC:H) means a specific precondition must be met first - for example a favorable network position to spoof or inject responses, or winning a timing/trust-state race - so it is not reliably reproducible. Impact is confined to low-level integrity tampering (I:L) with no confidentiality or availability effect, making this a genuinely low-priority issue despite being network-reachable and unauthenticated; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
Insecure default resource initialization in Dell SCG Policy Manager versions prior to 5.34.00.16 allows a high-privileged, local attacker to cause denial of service, disclose information, and bypass protection mechanisms. Exploitation requires local access, high privileges, and a specific high-complexity condition; no public exploit code has been identified at time of analysis. Dell has released patch 5.34.00.16 via advisory DSA-2026-385.
Cleartext transmission of sensitive information in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 exposes data to anyone able to observe network traffic to or from the product. The flaw is unauthenticated (PR:N) and requires no user interaction (UI:N), but its High attack complexity reflects that an attacker must first obtain an on-path position - a man-in-the-middle or passive-sniffing vantage point on the communication path - before any data can be read; confidentiality impact is rated High with no integrity or availability effect. At time of analysis there is no public exploit identified and no CISA KEV listing, so this is a moderate, defensively-weighted exposure rather than an actively exploited emergency. No EPSS score was supplied in the available intelligence.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an open redirect vulnerability that allows unauthenticated remote attackers to craft a link which, when followed by a victim user, redirects to an untrusted site and can lead to server-side request forgery (SSRF). The CVSS 3.1 base score is 5.4 (medium) due to the requirement for user interaction (UI:R) and low confidentiality/integrity impact. No public exploit code has been identified at time of analysis, and the vulnerability is not known to be actively exploited.
Elevation of privileges and protection-mechanism bypass in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 stem from an insecurely initialized default resource (CWE-1188). An attacker who already holds high privileges (PR:H) on the appliance can exploit the issue remotely with low complexity and no user interaction to escalate privileges, tamper with information, bypass protections, and gain unauthorized access. Impact is partial (C:L/I:L/A:N) rather than full compromise, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Leftover active debug code shipped in Dell Secure Connect Gateway (SCG) Policy Manager builds prior to 5.34.00.16 can be reached by a high-privileged local attacker, allowing limited information disclosure, information tampering, bypass of protection mechanisms, and unauthorized access. The assessed CVSS 3.1 vector (AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N, base score 3.0) restricts realistic exploitation to insiders or attackers who already hold administrator-equivalent local access on the SCG host, while the high attack complexity (AC:H) indicates additional, non-trivial conditions must be satisfied to actually invoke the debug code. No public exploit code has been identified and there is no confirmation of active exploitation at time of analysis, so this remains a low-priority, hardening-class issue best handled through routine patching.
Weak, reversible password encoding in Dell Secure Connect Gateway (SCG) Policy Manager lets a local, low-privileged user who already holds an account on the host recover stored credentials and abuse them for information disclosure, information tampering, protection-mechanism bypass and unauthorized access. The flaw affects versions prior to 5.34.00.16 and prior to 5.36 and is scored CVSS 6.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) - it is not remotely reachable and requires no user interaction, but it does require local access to the host plus a pre-existing low-privileged account, with the high attack complexity reflecting the work needed to locate and reverse the weak encoding. No public exploit identified at time of analysis, and this is a moderate, defense-in-depth issue rather than a front-line priority.
Improper TLS certificate validation in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 allows an unauthenticated attacker holding a man-in-the-middle position on an adjacent network segment to intercept and tamper with the appliance's TLS-protected traffic and to bypass protection mechanisms. The CVSS vector (AV:A/AC:H/PR:N/UI:N, C:H/I:H/A:N) confirms the attacker needs no credentials and no user interaction, but must be able to spoof or intercept traffic on the same/shared network and present a forged certificate that the affected component accepts, which keeps attack complexity high and makes this a moderate, defense-in-depth-grade issue rather than an internet-reachable emergency. No public exploit code identified at time of analysis and no confirmed active exploitation; a vendor patch is available.
Privilege escalation in Dell Secure Connect Gateway (SCG) Policy Manager allows a low-privileged attacker positioned on the adjacent network to reuse a session token that the application fails to expire, bypassing protection mechanisms and gaining unauthorized access to resources beyond their authorization level. Exploitation is constrained: it requires adjacent-network access rather than internet reachability, an existing low-privileged account, victim user interaction, and high attack complexity, which limits reliability. Affected are versions prior to 5.34.00.16 per the Dell advisory (EUVD lists the boundary as <5.36.00.16, a discrepancy that should be verified against the vendor document). There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited; at a vendor CVSS of 6.4 the real-world urgency is low, though the confidentiality and integrity impact of a successful session-reuse attack is high.
Unauthorized access to protected functionality affects Dell Secure Connect Gateway (SCG) Policy Manager installations running versions prior to 5.34.00.16, where authorization decisions are made against non-canonical URL paths (CWE-647). Remote unauthenticated attackers (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, base 3.7) must craft an alternate but equivalent path representation that the Policy Manager's authorization logic normalizes differently from its request routing, allowing them to reach functions intended to be restricted - with only a limited integrity impact and no confidentiality or availability impact claimed by the vendor. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; the high attack complexity (AC:H) reflects that this is not a generic single-request attack against default configuration, which is why the issue is assessed as low priority despite being network-reachable and unauthenticated.
Dell Secure Connect Gateway (SCG) Policy Manager versions earlier than 5.34.00.16 render their web interface without anti-framing protections, allowing a remote attacker to embed the authenticated UI inside an attacker-controlled page and overlay decoy content to trick an operator into unintended clicks, yielding session theft and elevation of privileges. Dell rates the issue CVSS 5.4 (AV:N/AC:L/PR:L/UI:N, C:L/I:L/A:N), while the assessed vector raises the user-interaction requirement to UI:R because clickjacking-style UI redressing practically depends on the victim clicking the framed content while holding a valid, low-privileged session. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; the vendor has released a fixed build, 5.34.00.16, so this is a moderate-severity, low-real-priority issue.
Improper privilege management in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 lets an attacker who already holds a low-privileged authenticated account on the management interface escalate to unauthorized access with high confidentiality and integrity impact (CVSS 6.8, AV:N/AC:H/PR:L/UI:N). The weakness maps to CWE-269 and requires network reachability plus a non-trivial precondition (AC:H), so it is not triggerable by a fully unauthenticated remote attacker. No public exploit code has been identified and the flaw is not confirmed actively exploited (CISA KEV), so urgency is moderate and driven primarily by the mandatory low-privilege foothold; the vendor-released fix is version 5.34.00.16.
Elevation of privilege in Dell Secure Connect Gateway (SCG) Policy Manager (versions prior to the fixed build, reported as 5.34.00.16 in the CVE description and as 5.36.00.16 in ENISA EUVD data) lets an attacker who already holds high-privilege authenticated access to the appliance reach functionality that should be restricted, breaking authorization boundaries rather than authentication itself (CWE-863). The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2 High), so the network path is remote and low-complexity with no user interaction, but the PR:H prerequisite means the attacker must be a malicious or compromised admin/operator account - anonymous or low-privileged users cannot trigger it. There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is 0.27% (18th percentile) and the CISA SSVC decision is Exploitation: none, Automatable: no, Technical Impact: total, which makes this a moderate, patch-on-normal-cycle item rather than an emergency. A vendor patch is available per Dell's advisory (DSA-2026-385), though the exact minimum fixed version should be verified with Dell given the discrepancy between 5.34.00.16 and 5.36.00.16 across sources.
Incorrect permission assignment on critical resources in Dell Secure Connect Gateway (SCG) Policy Manager lets an authenticated, low-privileged local user on the SCG host read and modify files or objects that should have been restricted, producing high confidentiality and high integrity impact together with a bypass of the product's own protection mechanisms (CVSS 3.1 base 7.1, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). The practical prerequisite is a pre-existing foothold on the appliance - a local shell or a service account - so the realistic threat actor is an insider or someone who has already compromised the host; there is no remote or unauthenticated path to trigger the flaw and no user interaction is required. No public exploit code identified at time of analysis, EPSS is 0.09% (0th percentile) and CISA's SSVC assessment records exploitation as 'none' with automatable 'no', making this a moderate, non-urgent priority for organizations running the affected versions.
Privilege escalation in Dell Secure Connect Gateway (SCG) Policy Manager allows an authenticated, network-reachable low-privileged user to bypass authorization by manipulating a user-controlled key (object/resource identifier) that the application trusts, escalating to a higher-privileged role with high impact to confidentiality, integrity, and availability (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only installations running versions below the patched build are affected; the vulnerability is not remotely exploitable without credentials, requires no victim interaction, and per available intelligence there is no public exploit code and no confirmed active exploitation (CISA KEV not listed, SSVC exploitation: none, EPSS 0.18% / 6th percentile). The independence assessment rates this a credible but not emergency-level priority: the attacker must first hold valid low-privilege credentials, but once inside can turn a benign identifier into an elevation-of-privilege primitive.
Unauthenticated remote attackers can reach a critical function in Dell Secure Connect Gateway (SCG) Policy Manager without any authentication check, bypassing protection mechanisms to read sensitive information and gain unauthorized access; instances running versions prior to 5.34.00.16 are affected. The vulnerability carries a CVSS of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), with impact limited to confidentiality and access bypass - no integrity or availability impact is indicated. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) or EPSS signal in the supplied data, so real-world risk is primarily gated by whether the management service is reachable from an untrusted network.
Server-side request forgery in Dell Secure Connect Gateway (SCG) Policy Manager allows a remote attacker who already holds high-privilege (administrative) credentials to coerce the appliance into issuing requests to attacker-chosen destinations, causing information disclosure, unauthorized access, and bypass of protection mechanisms (CWE-918; CVE-2026-78024). The scope-change metric (S:C) indicates forged requests can affect systems beyond the vulnerable component, and the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N confirms the exploitation prerequisite is authenticated administrator access - this is the primary limiting factor and means unauthenticated or low-privileged remote users cannot trigger it. At time of analysis there is no public exploit identified and no confirmed active exploitation (CISA KEV: no; SSVC exploitation: none), EPSS is only 0.20% (9th percentile), and a vendor patch is available, so this ranks as a moderate, non-urgent priority despite its 8.7 'High' base score.
Authorization bypass in Dell Secure Connect Gateway (SCG) Policy Manager lets an authenticated, low-privileged user tamper with a user-controlled key to reach resources and actions reserved for higher-privileged accounts, resulting in elevation of privileges with high impact to confidentiality, integrity, and availability. Only SCG Policy Manager builds below the vendor-fixed release are affected; exploitation requires an existing valid low-privileged account plus network reachability to the product interface, so fully unauthenticated outsiders cannot trigger it. Risk is real but not emergency-grade: EPSS is low at 0.18 percent (7th percentile), CISA SSVC rates exploitation as none and automatable as no, and no public exploit has been identified at time of analysis. Vendor-released patches are available through Dell advisory DSA-2026-385.
Protection mechanism bypass in Dell Secure Connect Gateway (SCG) Policy Manager (versions below the vendor-fixed release) lets a remote, low-privileged attacker who already holds valid credentials on the appliance defeat intended authorization controls via a 'failing open' error-handling flaw (CWE-636). Successful exploitation yields high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) with no availability impact. EPSS is low at 0.20% (9th percentile), CISA SSVC records no observed exploitation, and no public exploit identified at time of analysis, so priority is elevated-but-not-emergency, driven mainly by exposure of the management interface and the presence of low-privileged accounts.
Improper X.509 certificate validation in Dell Secure Connect Gateway (SCG) Policy Manager lets an unauthenticated attacker who has already attained a man-in-the-middle position on the network path to the appliance substitute a forged or untrusted certificate and hijack the affected TLS session, with the potential to disrupt service, expose data, and execute code in the context of the connection. Exploitation is not opportunistic: per the independent assessment the vector is AV:N/AC:H/PR:N/UI:R, so an attacker must both intercept the network path and induce a victim or client to initiate or complete the affected TLS handshake, which meaningfully limits exposure where the Policy Manager sits on a trusted management segment. Risk is currently low-to-moderate in practice - EPSS is 0.18% (7th percentile), no public exploit code has been identified at time of analysis, and CISA SSVC records Exploitation: none - although the vendor CVSS of 8.8 (High) reflects total confidentiality, integrity, and availability impact if the MITM precondition is met.
Privilege escalation, filesystem access, and remote code execution in Dell Secure Connect Gateway (SCG) Policy Manager allow a low-privileged, authenticated remote attacker to move from limited access to full control of the affected host. Exploitation requires an existing low-privileged foothold on a network-reachable Policy Manager instance running a version prior to the fixed release; no victim interaction is needed and attack complexity is low (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8). There is no public exploit identified at time of analysis and the issue is not in CISA KEV; EPSS is 0.33% (24th percentile), so signals are mostly consistent and indicate a serious but not emergency-grade issue, with realistic risk concentrated where Policy Manager is exposed to untrusted networks or low-privilege credentials are easy to obtain.
Information disclosure in Dell Secure Connect Gateway (SCG) Policy Manager (CPE cpe:2.3:a:dell:secure_connect_gateway_(scg)_policy_manager) arises from an insecure default initialization of a resource (CWE-1188), meaning affected builds ship or configure a resource in a state that exposes sensitive data out of the box. Exploitation is not remote or anonymous: it requires an attacker who already has local access to the host and a low-privileged authenticated account (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), with no user interaction needed. Risk is moderate and urgency low despite the 7.1 base score: EPSS is only 0.09% (0th percentile), CISA SSVC rates Exploitation 'none' and Automatable 'no', and no public exploit code or confirmed active exploitation was identified at time of analysis.
Weak authentication throttling in Dell Secure Connect Gateway (SCG) Policy Manager allows unauthenticated remote attackers to mount sustained credential-guessing attacks against the login interface, potentially leading to privilege elevation, bypass of protection mechanisms, and unauthorized access to a management platform that brokers connectivity into managed Dell infrastructure. All SCG Policy Manager builds prior to the fixed release are affected (the Dell advisory cites 5.34.00.16, while ENISA EUVD data cites 5.36.00.16 - the discrepancy should be verified against the vendor advisory before patching decisions). The flaw is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and CWE-307, but exploitability is gated by credential strength and attempt volume: CISA's SSVC assessment rates it as not automatable and records no observed exploitation, EPSS is only 0.26% (16th percentile), and no public exploit code has been identified at time of analysis.
Elevation of privilege in Dell Secure Connect Gateway (SCG) Policy Manager lets an attacker who already holds a valid low-privileged account and network reachability to the appliance invoke privileged functionality that lacks a proper authorization check, producing high confidentiality, integrity, and availability impact (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). Exploitation is not remote-unauthenticated - a pre-existing low-privileged credential is a hard prerequisite. No public exploit code or confirmed active exploitation has been identified at time of analysis; EPSS is 0.16% (5th percentile), CISA SSVC rates exploitation as none and automatable as no, and a vendor patch is available.
Local privilege escalation in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 lets a low-privileged local user raise their privileges by abusing incorrectly assigned permissions on a critical resource. The flaw is not remotely or unauthenticated-exploitable: an attacker must already hold local, low-privileged access to the host (PR:L, AV:L), and exploitation additionally depends on a high-complexity precondition such as a race condition or a specific system state (AC:H) plus the mis-permissioned resource being present in the deployed configuration. No user interaction is required, and no public exploit identified at time of analysis; Dell has released a fix in 5.34.00.16 via advisory DSA-2026-385.
Cross-site request forgery in Dell Secure Connect Gateway (SCG) Policy Manager prior to the vendor-fixed build allows a remote, unauthenticated attacker to ride an already-authenticated administrator's browser session and issue state-changing requests, resulting in information disclosure, information tampering, protection-mechanism bypass, and potential use of the product as a launch point for phishing. Per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N), the attacker needs no credentials of their own but must trick a logged-in Policy Manager user - typically an administrator - into visiting attacker-controlled content or clicking a crafted link, so that user interaction (UI:R) is the sole barrier and cannot be skipped; the targeted appliance must also be reachable from the victim's browser and a valid session must be active. No public exploit code has been identified at time of analysis, EPSS is only 0.12% (1st percentile), and CISA's SSVC framework rates exploitation as none with automatable:yes and partial technical impact, so this is a genuine but not urgent issue for which a vendor patch is available.
Remote code execution in Dell Secure Connect Gateway (SCG) Policy Manager allows an unauthenticated, remote attacker to execute code or tamper with/disclose information on affected appliances by exploiting a missing integrity check on code the product downloads, affecting versions prior to 5.34.00.16 and prior to 5.36. Realistic exploitation requires the attacker to control or tamper with the content the Policy Manager retrieves - typically a man-in-the-middle position or a spoofed/compromised download source - which is why our assessment adjusts the vendor's 9.8 score to AC:H while retaining PR:N and UI:N. A vendor patch is available (5.36.00.16; 5.34.00.16 for the 5.34 branch), and there is no evidence of active exploitation or public exploit code; EPSS is 0.11% (1st percentile) and CISA SSVC rates exploitation as 'none' and automatable as 'no'.
Improper TLS certificate validation in Dell Secure Connect Gateway (SCG) Policy Manager lets a man-in-the-middle who already occupies an adjacent-network position intercept, forge or tamper with protected connections, exposing sensitive information and defeating protection mechanisms. Affected builds are all versions prior to 5.34.00.16 and prior to 5.36; the CVSS vector (AV:A/AC:L/PR:N/UI:N) indicates exploitation needs no credentials and no user interaction, but does require the attacker to be on the same or an adjacent network segment as the SCG Policy Manager rather than reaching it across the internet. No public exploit code and no active exploitation have been identified at time of analysis, CISA SSVC records Exploitation: none with Automatable: no, and EPSS is negligible at 0.08% (0th percentile), so risk is driven by network positioning and management-plane exposure rather than mass exploitation.
Information exposure in Dell Secure Connect Gateway (SCG) Policy Manager affects all deployments running versions prior to 5.34.00.16, where sensitive data is embedded directly in shipped source or client-delivered code (CWE-540) and can be recovered and read by a remote party that obtains those artifacts. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N scores 7.5 HIGH, describing a network-reachable, low-complexity, unauthenticated confidentiality-only flaw with no integrity or availability impact (PR:N in the vector confirms no authentication is required). No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so risk is driven by the value of whatever secrets are baked into the code and by the product's niche enterprise/appliance footprint rather than by observed attack activity.
Missing authentication for a critical function in Dell Secure Connect Gateway (SCG) Policy Manager before version 5.34.00.16 allows remote attackers to reach functionality that should require a credential check, resulting in unauthorized access with high confidentiality and integrity impact. The assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (7.4) confirms no privileges and no user interaction are required, while the high attack-complexity rating indicates a non-trivial precondition must be satisfied rather than a guaranteed single-request compromise. Real-world risk is bounded by exposure: the Policy Manager interface must be network-reachable, and SCG is a specialized enterprise gateway typically deployed in restricted management networks; no public exploit was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Code execution and unauthorized filesystem access in Dell Secure Connect Gateway (SCG) Policy Manager are achievable when a locally positioned, highly privileged attacker supplies directory-traversal sequences to a Policy Manager file-path handling feature (CWE-22), with exploitation additionally requiring user interaction and non-trivial conditions to line up (CVSS 6.3, CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Despite the HIGH confidentiality, integrity, and availability impacts in the vector, this is a moderate-severity, low-urgency issue: there is no remote or network vector, an authenticated high-privileged application account on the host is a prerequisite, user interaction is mandatory, and attack complexity is high, so practical risk is largely confined to insider or already-compromised-host scenarios. No public exploit identified at time of analysis, and a vendor patch is available via Dell DSA-2026-385, though the exact fixed version must be confirmed because the CVE description cites 5.34.00.16 while EUVD lists 5.36.00.16.
Server-side request forgery in Dell Secure Connect Gateway (SCG) Policy Manager affects versions prior to 5.34.00.16, letting an attacker who already holds high-privilege access to the management interface coerce the appliance into issuing requests to attacker-chosen destinations. Because the CVSS vector carries PR:H, this is not reachable by anonymous or low-privileged users, and the impact is limited to information disclosure (C:H) with no integrity or availability effect; scope is changed (S:C), so the server can be pivoted toward internal or backend resources outside its own security boundary. No public exploit code or confirmed active exploitation was identified at time of analysis, and the underlying high-privilege prerequisite keeps this a moderate-severity, low-urgency issue rather than a top remediation priority.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 can leak sensitive information through generated error messages when an unauthenticated remote attacker is able to provoke a specific application error condition. The assessed CVSS of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects that exploitation is high-complexity with confidentiality-only impact, and no public exploit code or confirmed active exploitation was identified at time of analysis. This is a genuinely low-priority issue whose signals are internally consistent rather than conflicting.
Dell Secure Connect Gateway (SCG) Policy Manager before 5.34.00.16 contains an improper check for unusual or exceptional conditions, allowing an authenticated, high-privileged remote attacker to tamper with information and bypass protection mechanisms. The flaw requires administrative-level access (PR:H), confining exploitation to malicious or compromised privileged operators; no public exploit code or active exploitation has been identified at time of analysis. Impact is limited to partial integrity and availability losses, with no confidentiality exposure, making this a low-priority issue despite the network attack vector.
Authenticated low-privileged users with network reach to Dell Secure Connect Gateway (SCG) Policy Manager instances running versions earlier than 5.34.00.16 can supply input of an unexpected type that the application accepts without validating it, resulting in limited information exposure and limited information tampering (assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N). Realistic exploitation is constrained by high attack complexity, meaning the attacker must first satisfy conditions outside their control such as a specific application state or timing, and by the prerequisite of an existing low-privilege foothold, so this is not a remote unauthenticated flaw against default configurations. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the overall risk is genuinely low rather than merely rated low.
Information tampering in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 arises because the product treats a less trusted source as authoritative (CWE-348), allowing data accepted from that source to be falsified. An unauthenticated, remote attacker (CVSS vector PR:N, AV:N) can trigger the condition without user interaction, but the high attack complexity (AC:H) means a specific precondition must be met first - for example a favorable network position to spoof or inject responses, or winning a timing/trust-state race - so it is not reliably reproducible. Impact is confined to low-level integrity tampering (I:L) with no confidentiality or availability effect, making this a genuinely low-priority issue despite being network-reachable and unauthenticated; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
Insecure default resource initialization in Dell SCG Policy Manager versions prior to 5.34.00.16 allows a high-privileged, local attacker to cause denial of service, disclose information, and bypass protection mechanisms. Exploitation requires local access, high privileges, and a specific high-complexity condition; no public exploit code has been identified at time of analysis. Dell has released patch 5.34.00.16 via advisory DSA-2026-385.
Cleartext transmission of sensitive information in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 exposes data to anyone able to observe network traffic to or from the product. The flaw is unauthenticated (PR:N) and requires no user interaction (UI:N), but its High attack complexity reflects that an attacker must first obtain an on-path position - a man-in-the-middle or passive-sniffing vantage point on the communication path - before any data can be read; confidentiality impact is rated High with no integrity or availability effect. At time of analysis there is no public exploit identified and no CISA KEV listing, so this is a moderate, defensively-weighted exposure rather than an actively exploited emergency. No EPSS score was supplied in the available intelligence.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an open redirect vulnerability that allows unauthenticated remote attackers to craft a link which, when followed by a victim user, redirects to an untrusted site and can lead to server-side request forgery (SSRF). The CVSS 3.1 base score is 5.4 (medium) due to the requirement for user interaction (UI:R) and low confidentiality/integrity impact. No public exploit code has been identified at time of analysis, and the vulnerability is not known to be actively exploited.
Elevation of privileges and protection-mechanism bypass in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 stem from an insecurely initialized default resource (CWE-1188). An attacker who already holds high privileges (PR:H) on the appliance can exploit the issue remotely with low complexity and no user interaction to escalate privileges, tamper with information, bypass protections, and gain unauthorized access. Impact is partial (C:L/I:L/A:N) rather than full compromise, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Leftover active debug code shipped in Dell Secure Connect Gateway (SCG) Policy Manager builds prior to 5.34.00.16 can be reached by a high-privileged local attacker, allowing limited information disclosure, information tampering, bypass of protection mechanisms, and unauthorized access. The assessed CVSS 3.1 vector (AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N, base score 3.0) restricts realistic exploitation to insiders or attackers who already hold administrator-equivalent local access on the SCG host, while the high attack complexity (AC:H) indicates additional, non-trivial conditions must be satisfied to actually invoke the debug code. No public exploit code has been identified and there is no confirmation of active exploitation at time of analysis, so this remains a low-priority, hardening-class issue best handled through routine patching.
Weak, reversible password encoding in Dell Secure Connect Gateway (SCG) Policy Manager lets a local, low-privileged user who already holds an account on the host recover stored credentials and abuse them for information disclosure, information tampering, protection-mechanism bypass and unauthorized access. The flaw affects versions prior to 5.34.00.16 and prior to 5.36 and is scored CVSS 6.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) - it is not remotely reachable and requires no user interaction, but it does require local access to the host plus a pre-existing low-privileged account, with the high attack complexity reflecting the work needed to locate and reverse the weak encoding. No public exploit identified at time of analysis, and this is a moderate, defense-in-depth issue rather than a front-line priority.
Improper TLS certificate validation in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 allows an unauthenticated attacker holding a man-in-the-middle position on an adjacent network segment to intercept and tamper with the appliance's TLS-protected traffic and to bypass protection mechanisms. The CVSS vector (AV:A/AC:H/PR:N/UI:N, C:H/I:H/A:N) confirms the attacker needs no credentials and no user interaction, but must be able to spoof or intercept traffic on the same/shared network and present a forged certificate that the affected component accepts, which keeps attack complexity high and makes this a moderate, defense-in-depth-grade issue rather than an internet-reachable emergency. No public exploit code identified at time of analysis and no confirmed active exploitation; a vendor patch is available.
Privilege escalation in Dell Secure Connect Gateway (SCG) Policy Manager allows a low-privileged attacker positioned on the adjacent network to reuse a session token that the application fails to expire, bypassing protection mechanisms and gaining unauthorized access to resources beyond their authorization level. Exploitation is constrained: it requires adjacent-network access rather than internet reachability, an existing low-privileged account, victim user interaction, and high attack complexity, which limits reliability. Affected are versions prior to 5.34.00.16 per the Dell advisory (EUVD lists the boundary as <5.36.00.16, a discrepancy that should be verified against the vendor document). There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited; at a vendor CVSS of 6.4 the real-world urgency is low, though the confidentiality and integrity impact of a successful session-reuse attack is high.
Unauthorized access to protected functionality affects Dell Secure Connect Gateway (SCG) Policy Manager installations running versions prior to 5.34.00.16, where authorization decisions are made against non-canonical URL paths (CWE-647). Remote unauthenticated attackers (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, base 3.7) must craft an alternate but equivalent path representation that the Policy Manager's authorization logic normalizes differently from its request routing, allowing them to reach functions intended to be restricted - with only a limited integrity impact and no confidentiality or availability impact claimed by the vendor. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; the high attack complexity (AC:H) reflects that this is not a generic single-request attack against default configuration, which is why the issue is assessed as low priority despite being network-reachable and unauthenticated.
Dell Secure Connect Gateway (SCG) Policy Manager versions earlier than 5.34.00.16 render their web interface without anti-framing protections, allowing a remote attacker to embed the authenticated UI inside an attacker-controlled page and overlay decoy content to trick an operator into unintended clicks, yielding session theft and elevation of privileges. Dell rates the issue CVSS 5.4 (AV:N/AC:L/PR:L/UI:N, C:L/I:L/A:N), while the assessed vector raises the user-interaction requirement to UI:R because clickjacking-style UI redressing practically depends on the victim clicking the framed content while holding a valid, low-privileged session. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; the vendor has released a fixed build, 5.34.00.16, so this is a moderate-severity, low-real-priority issue.
Improper privilege management in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 lets an attacker who already holds a low-privileged authenticated account on the management interface escalate to unauthorized access with high confidentiality and integrity impact (CVSS 6.8, AV:N/AC:H/PR:L/UI:N). The weakness maps to CWE-269 and requires network reachability plus a non-trivial precondition (AC:H), so it is not triggerable by a fully unauthenticated remote attacker. No public exploit code has been identified and the flaw is not confirmed actively exploited (CISA KEV), so urgency is moderate and driven primarily by the mandatory low-privilege foothold; the vendor-released fix is version 5.34.00.16.