CVE-2025-36592: Dell Policy Manager For SCG XSS Vulnerability

CVE-2025-36592 Overview

CVE-2025-36592 is a Cross-Site Scripting (XSS) vulnerability affecting Dell Secure Connect Gateway (SCG) Policy Manager versions 5.20, 5.22, 5.24, 5.26, and 5.28. The flaw results from Improper Neutralization of Input During Web Page Generation [CWE-79]. An unauthenticated remote attacker can inject malicious scripts that execute in the browser of an authenticated user who interacts with a crafted request or link. Dell published advisory DSA-2025-391 addressing the issue.

Critical Impact
Successful exploitation enables script injection in the Policy Manager web interface, allowing attackers to hijack sessions, steal credentials, or perform actions in the context of authenticated administrators.

Affected Products

Dell Secure Connect Gateway Policy Manager 5.20
Dell Secure Connect Gateway Policy Manager 5.22, 5.24, 5.26
Dell Secure Connect Gateway Policy Manager 5.28

Discovery Timeline

2025-10-30 - CVE-2025-36592 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36592

Vulnerability Analysis

CVE-2025-36592 stems from insufficient output encoding in the Dell Secure Connect Gateway Policy Manager web interface. The application accepts user-supplied input and renders it into HTML responses without proper neutralization. When a victim opens a crafted URL or triggers the vulnerable request flow, the injected JavaScript executes within the victim's browser session.

The attack requires user interaction, as reflected in the CVSS vector component UI:R. However, no authentication is required to craft the malicious payload. Attackers typically deliver XSS payloads through phishing emails, malicious links, or embedded iframes that target administrators of the Policy Manager console.

Because the Policy Manager governs telemetry, remote support, and connectivity policies for Dell infrastructure, script execution against an administrator session can expose sensitive configuration data and enable lateral actions within the management interface.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The application fails to encode special characters such as <, >, ", and ' before reflecting user-controlled data into the HTML response, allowing attacker-supplied markup to be interpreted as executable script.

Attack Vector

The vulnerability is exploitable over the network with low attack complexity. An unauthenticated attacker crafts a malicious link or payload containing JavaScript. When an authenticated user of the Policy Manager clicks the link or loads the crafted content, the script executes in the context of the Policy Manager application. See the Dell Security Update DSA-2025-391 advisory for technical details.

Detection Methods for CVE-2025-36592

Indicators of Compromise

Web server access logs containing HTML tags, JavaScript keywords, or URL-encoded script payloads (%3Cscript%3E, onerror=, javascript:) in query parameters or POST bodies to the Policy Manager interface.
Unexpected outbound connections from administrator browsers to unknown domains shortly after loading Policy Manager pages.
Session anomalies such as concurrent logins from different IP addresses or unexpected privilege changes on the Policy Manager.

Detection Strategies

Inspect Policy Manager HTTP request logs for reflected input patterns containing HTML or script syntax.
Deploy web application firewall (WAF) rules that flag common XSS payload signatures directed at Policy Manager endpoints.
Correlate browser-side Content Security Policy (CSP) violation reports with administrator activity on the Policy Manager URL.

Monitoring Recommendations

Monitor administrator workstations for anomalous browser child processes or credential access attempts following Policy Manager sessions.
Alert on inbound requests to Policy Manager containing suspicious URL parameters from unknown external referrers.
Track authentication events and configuration changes on Dell SCG Policy Manager for correlation with potential session hijack activity.

How to Mitigate CVE-2025-36592

Immediate Actions Required

Apply the security update referenced in Dell advisory DSA-2025-391 to all instances of SCG Policy Manager running versions 5.20 through 5.28.
Restrict network access to the Policy Manager web interface to trusted administrative networks and VPN tunnels.
Train administrators to avoid clicking untrusted links that reference the Policy Manager hostname or IP.

Patch Information

Dell released fixes for this vulnerability through advisory DSA-2025-391. Administrators should upgrade to the fixed version listed in the advisory. Verify the update by checking the Policy Manager version banner after installation.

Workarounds

Enforce a strict Content Security Policy at any reverse proxy fronting the Policy Manager to limit inline script execution.
Require administrators to access Policy Manager from isolated browser profiles or dedicated privileged access workstations.
Disable or restrict access to the Policy Manager web interface until patching is complete if the console is not actively required.

bash

# Example: restrict Policy Manager access with iptables to a management subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP