Dell Secure Connect Gateway (SCG) Policy Manager is vulnerable to a cross‑site request forgery flaw that can be triggered by an unauthenticated attacker who can reach the system over the network. The attacker can forge requests that the gateway will accept as legitimate, enabling the disclosure of sensitive information, modification of configuration data, and launching of phishing campaigns. This weakness falls under CWE‑352 and allows attackers to bypass normal protection mechanisms.

Affected systems are all Dell Secure Connect Gateway (SCG) Policy Manager installations running versions older than 5.34.00.16. The vulnerability applies to the Policy Manager component; no other Dell products are listed as affected.

The CVSS score of 6.5 suggests moderately high severity, and the EPSS data is not currently available, so the current exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV, indicating that no publicly known exploits are documented as of now. Nevertheless, the nature of CSRF means that an attacker who can influence a user or a system component to send innocuous requests can hijack stateful actions without authentication. Risk is therefore governed by the ability of the attacker to achieve remote network access, and the impact can be quite broad if the policy manager controls critical network functions.