Description
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Code execution, Information disclosure, Information tampering, and Protection mechanism bypass.
Published: 2026-09-29
Score: 4.7 Medium
EPSS: n/a
KEV: No
Impact: Code execution, information disclosure, tampering, and protection mechanism bypass
Action: Patch ASAP
AI Analysis

Impact

This vulnerability is a Download of Code Without Integrity Check flaw that allows an unauthenticated attacker with remote access to download and execute arbitrary code. The flaw can be leveraged to execute code on the device, expose sensitive information, alter configurations or data, and bypass existing protection mechanisms. The impact is significant because it enables full control over the affected system without authentication.

Affected Systems

The flaw affects Dell Secure Connect Gateway (SCG) Policy Manager installations prior to version 5.34.00.16 and prior to 5.36. Any appliance running these versions is at risk if exposed to external networks.

Risk and Exploitability

The CVSS score of 4.7 indicates a moderate severity. EPSS data is currently unavailable, but the vulnerability is not listed in the CISA KEV catalog. An unauthenticated attacker can exploit the flaw remotely, typically by interacting with the SCG Policy Manager’s exposed services. The lack of authentication, coupled with remote reachability, increases the likelihood that the vulnerability could be used to compromise systems.

Generated by OpenCVE AI on September 30, 2026 at 03:09 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply Dell’s security update for Secure Connect Gateway Policy Manager to version 5.34.00.16 or newer (or version 5.36 and above).
  • Restrict network access to the SCG Policy Manager by configuring firewall rules or access control lists to limit connections to trusted IP ranges, thereby reducing exposure to unauthenticated attackers.
  • If possible, enable any available integrity verification mechanisms for downloaded code or enforce code signing checks to prevent execution of tampered binaries.

Generated by OpenCVE AI on September 30, 2026 at 03:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 05:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 30 Sep 2026 03:30:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Download of Code Without Integrity Check in Dell Secure Connect Gateway Policy Manager

Tue, 29 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
Description Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Code execution, Information disclosure, Information tampering, and Protection mechanism bypass.
Weaknesses CWE-494
References
Metrics cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-09-30T03:56:00.985Z

Reserved: 2026-08-13T11:04:26.934Z

Link: CVE-2026-73595

cve-icon Vulnrichment

Updated: 2026-09-29T15:37:06.751Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-29T12:17:11.427

Modified: 2026-09-30T04:18:31.030

Link: CVE-2026-73595

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T03:15:16Z

Weaknesses
  • CWE-494

    Download of Code Without Integrity Check