Dell Secure Connect Gateway Policy Manager suffers from an improper limitation on pathname use, allowing a path traversal flaw that can be leveraged by a high privileged attacker with local access to execute arbitrary code and read or write arbitrary files on the host. This weakness directly violates system confidentiality and integrity, potentially enabling full system compromise.

The vulnerability affects all Dell Secure Connect Gateway Policy Manager installations running versions prior to 5.34.00.16. The flaw is tied to the Policy Manager component, which processes file paths without adequate containment checks.

The CVSS score of 6.3 classifies the weakness as medium severity. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited publicly known exploitation. However, exploitation requires high privileged local access, meaning that it is most relevant to internal attackers or compromised service accounts. The attack vector is inferred to be local, based on the description that a high privileged attacker with local access could potentially exploit it.