Description
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to script injection.
Published: 2026-09-09
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a command injection flaw arising from improper neutralization of special elements used in commands. An unauthenticated attacker with remote access can inject and execute arbitrary scripts against the Dell Secure Connect Gateway 5.0 Appliance or Application, potentially compromising confidentiality, integrity, or availability of the system.

Affected Systems

Dell Secure Connect Gateway 5.0 Appliance versions earlier than 5.36.00.16 and Dell Secure Connect Gateway 5.0 Application versions earlier than 5.36.00.00 are affected. The flaw exists in both the appliance and application components of the Secure Connect Gateway 5.0 product line.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity vulnerability. No EPSS score is available, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is remote, through unauthenticated access to command interfaces exposed by the gateway. If exploited, an attacker could perform arbitrary command execution and script injection on the device.

Generated by OpenCVE AI on September 9, 2026 at 16:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Deploy the Dell security update DSA-2026-382, which upgrades the Appliance to 5.36.00.16 or later and the Application to 5.36.00.00 or later. The update patches the command injection flaw introduced by improper neutralization of command elements.
  • While awaiting the update, restrict remote access to the gateway to trusted internal networks or IP ranges, and disable or tightly control any console/credential interfaces that may allow unauthenticated command entry.
  • Continuously monitor gateway logs for anomalous or failed command injection attempts, and verify that the patch successfully removes the vulnerability by testing command execution paths.

Generated by OpenCVE AI on September 9, 2026 at 16:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 09 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 09 Sep 2026 17:00:00 +0000

Type Values Removed Values Added
Title Command Injection Vulnerability in Dell Secure Connect Gateway 5.0 Allowing Unauthenticated Remote Script Injection

Wed, 09 Sep 2026 15:15:00 +0000

Type Values Removed Values Added
Description Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to script injection.
Weaknesses CWE-77
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-09-09T16:10:35.905Z

Reserved: 2026-08-25T15:04:54.600Z

Link: CVE-2026-79941

cve-icon Vulnrichment

Updated: 2026-09-09T16:10:30.388Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-09-09T15:17:10.363

Modified: 2026-09-09T17:17:44.807

Link: CVE-2026-79941

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-09T16:45:13Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')