CVE-2026-80058 Overview
CVE-2026-80058 affects Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application editions. The vulnerability is a Cleartext Storage of Sensitive Information flaw [CWE-312] that exposes protected data to local attackers. Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 are affected. A low-privileged attacker with local access can read sensitive information stored without encryption on the appliance. Dell disclosed the issue in security advisory DSA-2026-382.
Critical Impact
Local low-privileged users can retrieve unencrypted sensitive data from the SCG appliance, resulting in high confidentiality impact without needing user interaction.
Affected Products
- Dell Secure Connect Gateway (SCG) 5.0 Appliance versions prior to 5.36.00.16
- Dell Secure Connect Gateway (SCG) 5.0 Application versions prior to 5.36.00.00
- Dell SCG Virtual Edition deployments referenced in DSA-2026-382
Discovery Timeline
- 2026-09-07 - CVE-2026-80058 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-80058
Vulnerability Analysis
The vulnerability is classified as Cleartext Storage of Sensitive Information under [CWE-312]. Dell SCG 5.0 stores sensitive data on the appliance file system without applying encryption or equivalent protection controls. Any local account with sufficient read access to the storage location can retrieve the data in its original form.
The SCG (Secure Connect Gateway) product brokers connections between customer infrastructure and Dell support services. It handles credentials, telemetry, and configuration data that require confidentiality guarantees. Storing this data in cleartext undermines the trust boundary between low-privileged local users and administrative secrets on the appliance.
Exploitation does not lead to code execution or data tampering. The impact is confined to disclosure of stored sensitive information, which may enable follow-on attacks against connected Dell infrastructure or downstream systems whose credentials were exposed.
Root Cause
The root cause is the absence of encryption or access-controlled key storage for sensitive fields written to disk by the SCG 5.0 Appliance and Application components. Data that should be protected at rest is instead written in cleartext, violating standard secure-storage practices.
Attack Vector
An attacker must first obtain low-privileged local access to the SCG appliance, for example through a shell account, misused service context, or compromised operator credentials. Once local, the attacker reads the affected files or datastore entries directly. No network access, elevated privileges, or user interaction is required beyond the initial local foothold.
No public proof-of-concept exploit code is available for CVE-2026-80058. Refer to the Dell Security Update DSA-2026-382 advisory for vendor technical details.
Detection Methods for CVE-2026-80058
Indicators of Compromise
- Unexpected read access to SCG configuration or credential storage paths by non-administrative accounts.
- Local shell sessions on the SCG appliance originating from service or low-privileged accounts outside normal operational windows.
- Presence of copied SCG configuration artifacts on operator workstations or external transfer destinations.
Detection Strategies
- Audit file system access logs on the SCG appliance for reads against sensitive configuration and datastore paths.
- Correlate local login events with subsequent file access to identify low-privileged accounts touching protected data.
- Baseline SCG appliance versions across the fleet and flag deployments running below 5.36.00.16 (Appliance) or 5.36.00.00 (Application).
Monitoring Recommendations
- Forward SCG appliance authentication and file access logs to a centralized analytics platform for retention and correlation.
- Alert on privilege changes, new local accounts, or SSH key additions on SCG hosts.
- Track outbound data transfers from SCG appliances to detect exfiltration of harvested cleartext data.
How to Mitigate CVE-2026-80058
Immediate Actions Required
- Upgrade Dell SCG 5.0 Appliance to version 5.36.00.16 or later.
- Upgrade Dell SCG 5.0 Application to version 5.36.00.00 or later.
- Rotate any credentials, API tokens, or secrets that were stored on affected SCG deployments prior to the upgrade.
- Review and reduce local account access on SCG appliances to the minimum required set.
Patch Information
Dell released fixes as documented in Dell Security Update DSA-2026-382. Apply the vendor-supplied update for both the Appliance and Application form factors of SCG 5.0 to eliminate the cleartext storage condition.
Workarounds
- Restrict local shell and console access on SCG appliances to administrative personnel only.
- Enforce host-level access controls and file permissions to limit which accounts can read SCG datastore paths.
- Isolate SCG management interfaces on a dedicated administrative network segment until patching is complete.
# Configuration example
# Verify installed SCG version and plan the upgrade referenced in DSA-2026-382
# Replace with the actual command supported by your SCG deployment
scg-cli system version
# Expected post-patch output for Appliance: 5.36.00.16 or later
# Expected post-patch output for Application: 5.36.00.00 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
