Dell Secure Connect Gateway 5.0 versions before 5.36.00.16 for the appliance and before 5.36.00.00 for the application contain hard‑coded credentials that can be accessed by an unauthenticated attacker with remote access. This flaw permits the attacker to authenticate as a privileged user without possessing legitimate credentials, leading to potential data exposure and other unauthorized actions. The vulnerability is classified as a Use of Hard‑Coded Credentials deficiency (CWE‑798).

The affected products are Dell Secure Connect Gateway 5.0 Appliance and Dell Secure Connect Gateway 5.0 Application, with all versions prior to 5.36.00.16 for appliance and prior to 5.36.00.00 for application being vulnerable.

The CVSS score of 7.5 indicates a high risk to confidentiality and possibly integrity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attacker can exploit the vulnerability over a remote connection without authentication, making the attack vector readily feasible. Exploitation requires only network access to the SCG services; no local privileges or insider knowledge are needed, which increases the likelihood of compromise.