CVE-2026-61409: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Dell Secure Connect Gateway (SCG) 5.0 Application

CVE-2026-61409 describes an OS Command Injection vulnerability in Dell Secure Connect Gateway (SCG) 5.0 Application versions before 5.36.00.00. This vulnerability arises from improper neutralization of special elements used in OS commands, enabling an unauthenticated remote attacker to execute arbitrary commands on the affected system. The CVSS v3.1 base score is 7.3, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.

An unauthenticated attacker with remote access could exploit this vulnerability to execute arbitrary OS commands, potentially leading to partial loss of confidentiality, integrity, and availability of the affected system. This could allow unauthorized control or disruption of the Dell SCG application environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, restrict remote access to the affected application and monitor for suspicious activity related to command execution attempts.