Dell Secure Connect Gateway Policy Manager versions prior to 5.34.00.16 suffer from an initialization of a resource with an insecure default. A low‑privileged attacker with local access can read sensitive configuration or credential data exposed by the policy manager, leading to information disclosure. This flaw is a type of resource initialization weakness (CWE‑1188) that allows data exposure without modifying system state.

The affected product is Dell Secure Connect Gateway Policy Manager. All releases before 5.34.00.16 are vulnerable; any installation of SCG Policy Manager in this range should be considered at risk until patched.

The flaw has a medium CVSS score of 6.3. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, indicating it has not yet been widely observed in the wild. Exploitation requires low privilege and local access, so the attack vector is local only. Because the vulnerability leads only to information disclosure and does not grant remote code execution or privilege escalation, the overall risk boils down to the number of SCG Policy Manager instances exposed to untrusted local users and the sensitivity of the configuration data stored.