CVE-2025-46696

MediumCVSS 6.7/10Last modified Oct 14, 2026

Description

Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application, version(s) versions 5.26 to 5.30, contain(s) an Execution with Unnecessary Privileges vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-250

Affected software

Vendor	Product	Versions
Dell	Secure Connect Gateway (SCG) Appliance	>= N/A, < 5.32.00.20
Dell	Secure Connect Gateway (SCG) Application	>= 5.26.00, < 5.32.00

References

https://www.dell.com/support/kbdoc/en-us/000385230/dsa-2025-390-dell-secure-connect-gateway-security-update-for-multiple-vulnerabilitiesVendor Advisory

Timeline

Published: Jan 6, 2026
Last modified: Oct 14, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-466996.5Dell Data Protection Advisor, versions prior to 19.12, contains an Improper Neutralization of Special Elements Used in a Template Engine vul CVE-2025-46705.4The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scriptin CVE-2025-467017.3Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints CVE-2025-467025.4Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce chann CVE-2025-467036.4Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:AtMentions) allows Cross-Site Scripting (XSS)CVE-2025-467044.3A vulnerability exists in Advantech iView in NetworkServlet.processImportRequest() that could allow for a directory traversal attack. This CVE-2025-467057.5A denial of service vulnerability exists in the g_assert_not_reached functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially cra CVE-2025-467067.5When an iRule containing the HTTP::respond command is configured on a virtual server, undisclosed requests can cause an increase in memory r CVE-2025-467075.2Software installed and running inside a Guest VM may override Firmware's state and gain access to the GPU.CVE-2025-467084.3Software installed and running inside a Guest VM may conduct improper GPU system calls to prevent other Guests from running work on the GPU.CVE-2025-467097.5Possible memory leak or kernel exceptions caused by reading kernel heap data after free or NULL pointer dereference kernel exception.CVE-2025-46716.4The Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's user_meta and compare shortcodes in a