Skip to main content

Dell Secure Connect Gateway CVE-2026-79727

| EUVDEUVD-2026-74796 LOW
Exposure of Sensitive System Information Due to Uncleared Debug Information (CWE-1258)
2026-09-09 dell GHSA-6c5c-9xfr-29xv
3.3
CVSS 3.1 · Vendor: dell
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain low-privileged local OS credentials
  2. Delivery
    Authenticate to SCG 5.0 host locally
  3. Exploit
    Locate uncleared debug artifact files on filesystem
  4. Execution
    Read sensitive system information from debug data
  5. Impact
    Use harvested data for reconnaissance or further exploitation

Vulnerability Assessment

Weakness
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Hardware debug access restrictions
Exploitation Conditions

Exploitation requires the attacker to hold a valid low-privileged local account on the Dell SCG 5.0 host (PR:L per CVSS). Remote unauthenticated exploitation is not possible - AV:L confirms local system access is mandatory. The vulnerability exists in both the Appliance and Application deployment forms of SCG 5.0. No special feature flag or non-default configuration is required beyond having any authenticated local OS session. Limiting factors: local access is the primary barrier; environments that restrict local shell access to SCG hosts to administrators only are substantially protected.

Impact

The CVSS 3.1 base score of 3.3 (Low) accurately reflects the constrained exploitation conditions: AV:L confirms local system access is required, PR:L confirms the attacker must hold a valid low-privileged account, and the impact is strictly limited to partial confidentiality (C:L) with no integrity or availability consequence. No EPSS data was provided in the input, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. No public proof-of-concept is known. The practical risk is limited to insider threats, post-exploitation lateral movement reconnaissance, or scenarios where an attacker has already achieved local foothold through a separate vulnerability. The severity is low and this should be deprioritized behind network-reachable vulnerabilities in the same environment, though patch application is straightforward given the vendor fix availability.

Exploit ScenarioDerived

An attacker who has gained low-privileged local access to a Dell SCG 5.0 host - whether through credential theft, another vulnerability, or a malicious insider - navigates to the filesystem location containing uncleared debug artifacts. Without requiring any elevated privileges, the attacker reads the debug files to harvest sensitive system information such as internal configuration details, credential fragments, or network topology data, which can be used to further lateral movement or escalation within the environment.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 09, 2026

Dell Secure Connect Gateway (SCG) 5.0 exposes sensitive system information through uncleared debug artifacts accessible to local low-privileged users, affecting both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00). The root cause is CWE-1258: debug data containing sensitive system details is not purged and remains readable on the local filesystem. No public exploit code has been identified and exploitation requires local authenticated access, making real-world impact limited to insider threat scenarios or post-compromise reconnaissance.

RemediationAI

Upgrade Dell Secure Connect Gateway 5.0 Appliance to version 5.36.00.16 or later and the Application variant to version 5.36.00.00 or later per Dell advisory DSA-2026-382 at https://www.dell.com/support/kbdoc/en-in/000503426/. If immediate patching is not feasible, restrict local shell or OS-level access to SCG hosts to the minimum set of privileged administrators only, removing any non-administrative local accounts. Audit existing debug log directories for sensitive data exposure and manually purge residual debug artifacts as an interim compensating control. Note that restricting local login access may impact break-glass procedures that rely on console or local user access.

Affected VersionsENISA

Secure Connect Gateway 5.0 - Application 0 <5.36.00.00 or later
Secure Connect Gateway 5.0 - Appliance 0 <5.36.00.16 or later

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Dell Secure Connect Gateway 5.0 is an enterprise remote support gateway product offered in two deployment forms: a virtual/physical appliance (cpe:2.3:a:dell:secure_connect_gateway_5.0_-_appliance) and a software application (cpe:2.3:a:dell:secure_connect_gateway_5.0_-_application). CWE-1258 describes a class of vulnerabilities where debug data - logs, traces, core dumps, or diagnostic files - is generated during development or troubleshooting and left in a world- or group-readable location in production builds. This residual debug information commonly includes configuration details, internal system paths, credential fragments, API tokens, or network topology data. In this case, the SCG debug artifacts are accessible to any authenticated local user regardless of their privilege level, providing a low-effort information-gathering channel after initial foothold on the appliance or application host.

Know when Secure Connect Gateway 5 0 Appliance gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources

No credit card · 7-day full trial

Severity by source

Vendor (dell) PRIMARY 3.3 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
vuln.today AI 3.3 LOW

Local access and low privileges required to read debug files; only partial confidentiality impacted, no integrity or availability consequence.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (dell).

CVSS VectorVendor: dell

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

1
Patch available
Sep 09, 2026 - 11:03 EUVD

DescriptionCVE.org

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.

Threat Intelligence Overview

EPSS Score
0.1%
Top 99% exploitable
Prevalence
Medium
enterprise Dell infrastructure gateway, deployed in Dell-heavy shops
Data Quality
5 sources
Confidence: Medium

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity LOW
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
LOW severity (CVSS 0.1-3.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact· derived
Low
Technical Impact
Partial

Priority Score

16
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +16
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

CVE-2026-80131 CRITICAL
9.8 Sep 07

Remote code execution in Dell Secure Connect Gateway (SCG) 5.0 allows an unauthenticated remote attacker to escape the i

CVE-2026-80172 CRITICAL
9.8 Sep 09

Unauthorized ADMIN access in Dell Secure Connect Gateway (SCG) 5.0 allows a remote unauthenticated attacker to replay a

CVE-2026-61410 CRITICAL
9.4 Sep 07

Remote command execution in Dell Secure Connect Gateway 5.0 (Appliance versions before 5.36.00.16 and Application versio

CVE-2026-80164 CRITICAL
9.1 Sep 07

Unauthorized remote access to Dell Secure Connect Gateway (SCG) 5.0 is possible because the product fails to properly va

CVE-2026-80130 HIGH
8.8 Sep 07

Relative path traversal in Dell Secure Connect Gateway (SCG) 5.0 allows a low-privileged remote attacker to traverse dir

CVE-2026-79645 HIGH
8.2 Sep 07

Missing authentication on critical API functions in Dell Secure Connect Gateway (SCG) 5.0 exposes privileged operations

CVE-2026-78491 HIGH
8.2 Sep 09

Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows remote unauthenticated attackers to expl

CVE-2026-80133 HIGH
8.1 Sep 07

Relative path traversal in Dell Secure Connect Gateway 5.0 (both Appliance and Application editions) exposes unauthentic

CVE-2026-80132 HIGH
8.1 Sep 07

Dell Secure Connect Gateway (SCG) 5.0 exposes a critical management function without any authentication requirement (CWE

CVE-2026-78484 HIGH
7.8 Sep 09

OS command injection in Dell Secure Connect Gateway (SCG) 5.0 enables a locally authenticated low-privilege attacker to

CVE-2026-78493 HIGH
7.8 Sep 09

OS command injection in Dell Secure Connect Gateway (SCG) 5.0 - both Appliance (prior to 5.36.00.16) and Application (pr

CVE-2026-80178 HIGH
7.8 Sep 07

Local privilege escalation in Dell Secure Connect Gateway 5.0 enables a low-privileged authenticated user with local she

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy