CVE-2026-79975: Dell SCG 5.0 SSRF Vulnerability

CVE-2026-79975 Overview

CVE-2026-79975 affects Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application editions. The flaw is an Improper Certificate Validation weakness [CWE-295] that a low-privileged local attacker can exploit to trigger server-side request forgery (SSRF). Dell tracks the issue under advisory DSA-2026-382 and has released fixed builds. Because the appliance mediates support connectivity between customer environments and Dell backend services, insufficient validation of TLS certificates can allow an attacker to redirect outbound requests to unintended internal or external destinations.

Critical Impact
A local, low-privileged attacker can abuse improper certificate validation in Dell SCG 5.0 to coerce the appliance into issuing attacker-controlled server-side requests, exposing sensitive internal resources.

Affected Products

Dell Secure Connect Gateway (SCG) 5.0 Appliance versions prior to 5.36.00.16
Dell Secure Connect Gateway (SCG) 5.0 Application versions prior to 5.36.00.00
Dell SCG Virtual Edition deployments covered by advisory DSA-2026-382

Discovery Timeline

2026-09-07 - CVE-2026-79975 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-79975

Vulnerability Analysis

Dell SCG is a virtual appliance that brokers outbound telemetry, RMA, and remote support sessions between customer infrastructure and Dell's cloud endpoints. The vulnerability stems from improper validation of X.509 certificates presented by remote hosts contacted by the gateway. When certificate chain, hostname, or trust anchor checks are incomplete, the appliance accepts connections to hosts it should reject.

An attacker with local, low-privileged access to the appliance can influence outbound request destinations. The appliance then issues requests on the attacker's behalf, producing a server-side request forgery condition. Because SCG typically resides in a management network with elevated reachability, the SSRF primitive can reach internal services normally inaccessible to the attacker.

The issue is limited to confidentiality impact. Exploitation does not modify data on the appliance or interrupt service, but it can leak sensitive metadata, credentials embedded in intranet responses, or cloud instance metadata endpoints.

Root Cause

The root cause is improper certificate validation [CWE-295] in the outbound HTTPS client logic of Dell SCG 5.0. The client does not fully verify the presented certificate against a trusted chain or expected hostname, allowing redirection to unintended TLS endpoints without triggering a validation failure.

Attack Vector

The attacker requires local access to the SCG appliance with low privileges and no user interaction. After authenticating, the attacker manipulates configuration or requests that drive the appliance's outbound HTTPS calls. Because certificate validation is weak, the appliance completes TLS handshakes with attacker-selected destinations and returns response data or side effects that constitute the SSRF.

No verified proof-of-concept code is publicly available. Refer to the Dell Security Update Advisory DSA-2026-382 for authoritative technical details.

Detection Methods for CVE-2026-79975

Indicators of Compromise

Outbound HTTPS connections from the SCG appliance to hosts outside Dell's published support endpoint ranges.
TLS sessions from the appliance negotiated with certificates issued by unexpected certificate authorities.
Unusual DNS resolutions originating from the SCG appliance targeting internal RFC1918 hosts or cloud metadata addresses such as 169.254.169.254.

Detection Strategies

Baseline the appliance's normal outbound destinations and alert on deviations at the network egress layer.
Inspect SCG audit logs for configuration changes made by low-privileged accounts that could influence outbound URLs.
Correlate authentication events on the SCG with subsequent anomalous outbound requests using SIEM correlation rules.

Monitoring Recommendations

Forward SCG appliance logs and network flow telemetry to a centralized analytics platform for retention and correlation.
Monitor certificate chains observed on outbound TLS from the appliance and flag self-signed or untrusted issuers.
Review privileged and low-privileged local account activity on the appliance on a recurring cadence.

How to Mitigate CVE-2026-79975

Immediate Actions Required

Upgrade Dell SCG 5.0 Appliance to version 5.36.00.16 or later.
Upgrade Dell SCG 5.0 Application to version 5.36.00.00 or later.
Audit all local accounts on the SCG appliance and remove or rotate credentials for unused low-privileged users.
Restrict management-plane access to the SCG appliance to a limited set of administrative hosts.

Patch Information

Dell has released fixed builds addressed in advisory DSA-2026-382. Customers should apply the updates published at the Dell Security Update Advisory. Appliance operators should schedule the update during a maintenance window and validate outbound connectivity to Dell endpoints after upgrade.

Workarounds

Place the SCG appliance in a segmented management VLAN with strict egress filtering to only Dell-published destinations.
Deny outbound connectivity from the appliance to internal service subnets and cloud metadata endpoints.
Enforce least privilege for local SCG accounts and disable interactive access for service accounts where feasible.

bash

# Example egress restriction using iptables on an upstream gateway
iptables -A FORWARD -s <SCG_APPLIANCE_IP> -d 169.254.169.254 -j DROP
iptables -A FORWARD -s <SCG_APPLIANCE_IP> -d 10.0.0.0/8 -j DROP
iptables -A FORWARD -s <SCG_APPLIANCE_IP> -p tcp --dport 443 -m set --match-set dell_endpoints dst -j ACCEPT
iptables -A FORWARD -s <SCG_APPLIANCE_IP> -j DROP