CVE-2025-26475: Dell Secure Connect Gateway Auth Bypass Flaw

CVE-2025-26475 Overview

CVE-2025-26475 affects Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version 5.26. The advisory relates to the Docker Live-Restore configuration, which keeps containers running during daemon restarts. When properly enabled, this setting reduces attack exposure, prevents accidental misconfigurations, and helps ensure security controls remain active during maintenance operations. The issue is tracked under CWE-287 (Improper Authentication) in the National Vulnerability Database.

Critical Impact
An attacker with low privileges and user interaction can achieve limited impact on confidentiality, integrity, and availability with scope change on the SCG appliance.

Affected Products

Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS
Version 5.26 (virtual appliance)
CPE: cpe:2.3:a:dell:secure_connect_gateway:5.26.00.20:*:*:*:virtual:*:*:*

Discovery Timeline

2025-03-19 - CVE-2025-26475 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26475

Vulnerability Analysis

Dell Secure Connect Gateway is a remote support communication solution that connects Dell infrastructure to Dell's support systems for telemetry, monitoring, and remote troubleshooting. The SCG 5.0 Appliance runs containerized workloads managed by the Docker daemon.

This advisory concerns the Docker Live-Restore configuration on the SCG appliance. Without Live-Restore enabled, restarting the Docker daemon stops all containers, which momentarily disables the security controls those containers enforce. Attackers with local access could exploit that window to bypass runtime protections or introduce misconfigurations that persist after the daemon returns to service.

The weakness is classified as improper authentication [CWE-287]. Exploitation requires network access, high attack complexity, low privileges, and user interaction, and results in a scope change with limited impact across confidentiality, integrity, and availability.

Root Cause

The root cause is the absence of Live-Restore protection in the container runtime configuration on affected SCG versions. Container security controls become inactive during daemon restarts, creating an opportunity for authentication and policy enforcement checks to be bypassed.

Attack Vector

An authenticated attacker on the network who can trigger or wait for a daemon restart, combined with user interaction, may exercise the exposure. The scope change indicates that impact can extend beyond the vulnerable component to other resources managed by the appliance.

No public proof-of-concept exploit exists for CVE-2025-26475, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Dell Security Update Advisory for authoritative technical details.

Detection Methods for CVE-2025-26475

Indicators of Compromise

Unexpected Docker daemon restarts on the SCG appliance outside of scheduled maintenance windows
Container state transitions that coincide with configuration changes to /etc/docker/daemon.json
Gaps in container-generated security telemetry that align with daemon service events

Detection Strategies

Inventory SCG appliances and identify instances running version 5.26 that lack the Live-Restore setting
Monitor systemd journal entries for docker.service restart events on SCG hosts
Correlate container runtime logs with authentication and access events to identify enforcement gaps

Monitoring Recommendations

Alert on modifications to Docker daemon configuration files on the SCG appliance
Track container uptime and restart counts to identify anomalous lifecycle activity
Forward SCG appliance logs to a centralized SIEM for retention and correlation across the estate

How to Mitigate CVE-2025-26475

Immediate Actions Required

Apply the Dell security update referenced in KB article 000291028 to affected SCG 5.0 Appliance instances
Verify that Live-Restore is enabled on the Docker daemon after patching
Restrict network access to the SCG management interface to trusted administrative networks only

Patch Information

Dell has published remediation guidance in the Dell Secure Connect Gateway Security Update advisory. Administrators should follow the version upgrade path described by Dell for SCG 5.0 Appliance - SRS.

Workarounds

Enable the Docker live-restore option in /etc/docker/daemon.json and reload the daemon
Schedule daemon restarts during controlled maintenance windows with compensating monitoring in place
Limit administrative access to the appliance to reduce the population able to trigger restart conditions

bash

# Configuration example: enable Docker Live-Restore
# /etc/docker/daemon.json
{
  "live-restore": true
}

# Reload the daemon configuration without stopping containers
sudo systemctl reload docker

# Verify the setting is active
docker info --format '{{.LiveRestoreEnabled}}'