Description
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to script injection.
Published: 2026-09-09
Score: 5.3 Medium
EPSS: 4.7% Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Dell Secure Connect Gateway 5.0 Appliance and Application versions earlier than 5.36.00.16 and 5.36.00.00 contain an OS Command Injection flaw caused by improper neutralization of special elements used in an operating‑system command. An attacker with unauthenticated remote access could inject shell commands, potentially leading to script injection on the gateway.

Affected Systems

Dell Secure Connect Gateway 5.0 Appliance versions prior to 5.36.00.16 and Dell Secure Connect Gateway 5.0 Application versions prior to 5.36.00.00 are affected patch that mitigates the command injection vulnerability.

Risk and Exploitability

The CVSS base score of 5.3 indicates moderate severity, while the EPSS score is 5% and the vulnerability is not listed in CISA KEV. An attacker requires only remote access with no authentication, making the attack vector straightforward. Although the EPSS score of 5% suggests a moderately low exploit probability, the potential impact of remote code execution warrants prompt remediation.

Generated by OpenCVE AI on September 25, 2026 at 01:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply Dell Security Advisory DSA‑2026‑382 to upgrade to at least 5.36.00.16 for the Appliance or 5.36.00.00 for the Application.
  • Configure firewall rules or apply network segmentation so that only trusted internal networks can reach the gateway’s management interfaces, reducing the exposure to unauthenticated remote access.
  • After upgrading, enable detailed logging on the gateway and regularly review logs for any unauthorized command execution or anomalous activity.

Generated by OpenCVE AI on September 25, 2026 at 01:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 01:45:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell Secure Connect Gateway 5.0 Appliance and Application

Fri, 11 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 10 Sep 2026 15:00:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell Secure Connect Gateway 5.0 Appliance and Application

Wed, 09 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Dell
Dell secure Connect Gateway
CPEs cpe:2.3:a:dell:secure_connect_gateway:*:*:*:*:application:*:*:*
cpe:2.3:a:dell:secure_connect_gateway:*:*:*:*:virtual:*:*:*
Vendors & Products Dell
Dell secure Connect Gateway

Wed, 09 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Description Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to script injection.
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Dell Secure Connect Gateway
cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-09-11T13:06:07.370Z

Reserved: 2026-08-25T12:04:33.630Z

Link: CVE-2026-79689

cve-icon Vulnrichment

Updated: 2026-09-11T12:56:29.780Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-09T16:17:07.197

Modified: 2026-09-11T13:18:17.583

Link: CVE-2026-79689

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T01:30:20Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')