Description
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to command execution.
Published: 2026-09-07
Score: 6.5 Medium
EPSS: 4.8% Low
KEV: No
Impact: Remote Command Execution
Action: Patch Immediately
AI Analysis

Impact

An OS Command Injection flaw allows a low‑privileged attacker with remote access to inject arbitrary operating‑system commands. If exploited, the attacker could execute arbitrary code on the device, compromising confidentiality, integrity, and availability. The weakness is formally identified as CWE‑78.

Affected Systems

The vulnerability impacts Dell Secure Connect Gateway 5.0 Appliance versions older than 5.36.00.16 and Dell Secure Connect Gateway 5.0 Application versions older than 5.36.00.00, which provide secure connectivity services.

Risk and Exploitability

The CVSS score of 6.5 indicates medium severity. The EPSS score of 5% suggests a low but non‑zero likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can remotely reach the appliance or application with low privileges, then inject commands via exposed interfaces, allowing arbitrary code execution.

Generated by OpenCVE AI on September 25, 2026 at 00:03 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply Dell Security Update 2026‑382 to upgrade Dell Secure Connect Gateway 5.0 Appliance to at least 5.36.00.16 and the Application to at least 5.36.00.00.
  • Restrict remote access for low‑privileged users by enforcing strong authentication, using VPNs, and limiting network reachability to the appliance and application.
  • Monitor system logs and network traffic for unexpected command execution patterns and anomalous activity that may indicate exploitation attempts.

Generated by OpenCVE AI on September 25, 2026 at 00:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 00:30:00 +0000

Type Values Removed Values Added
Title Dell Secure Connect Gateway OS Command Injection Vulnerability

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Dell secure Connect Gateway
CPEs cpe:2.3:a:dell:secure_connect_gateway:*:*:*:*:application:*:*:*
cpe:2.3:a:dell:secure_connect_gateway:*:*:*:*:virtual:*:*:*
Vendors & Products Dell secure Connect Gateway

Wed, 09 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 08 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Dell
Dell secure Connect Gateway Appliance
Dell secure Connect Gateway Application
Vendors & Products Dell
Dell secure Connect Gateway Appliance
Dell secure Connect Gateway Application

Tue, 08 Sep 2026 15:45:00 +0000

Type Values Removed Values Added
Title Remote Command Execution via OS Command Injection in Dell Secure Connect Gateway 5.0

Mon, 07 Sep 2026 15:45:00 +0000

Type Values Removed Values Added
Title Remote Command Execution via OS Command Injection in Dell Secure Connect Gateway 5.0

Mon, 07 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Description Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to command execution.
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Dell Secure Connect Gateway Secure Connect Gateway Appliance Secure Connect Gateway Application
cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-09-09T14:42:28.214Z

Reserved: 2026-08-24T17:05:26.110Z

Link: CVE-2026-78488

cve-icon Vulnrichment

Updated: 2026-09-09T14:42:21.823Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-07T15:17:31.790

Modified: 2026-09-11T21:22:54.260

Link: CVE-2026-78488

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T00:15:14Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')