CVE-2026-80124: Dell Secure Connect Gateway Log Vulnerability

CVE-2026-80124 Overview

Dell Secure Connect Gateway (SCG) 5.0 contains an information disclosure vulnerability caused by sensitive data written to log files. The flaw affects Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00. A low-privileged attacker with local access to the appliance can read log files and extract sensitive information. The issue is tracked as [CWE-532: Insertion of Sensitive Information into Log File]. Dell addressed the vulnerability in security advisory DSA-2026-382.

Critical Impact
A local, low-privileged attacker can read log files on Dell SCG appliances to obtain sensitive information intended to remain confidential.

Affected Products

Dell Secure Connect Gateway 5.0 Appliance (Virtual Edition) versions prior to 5.36.00.16
Dell Secure Connect Gateway 5.0 Application versions prior to 5.36.00.00
Dell Secure Connect Gateway (CPE: dell:secure_connect_gateway)

Discovery Timeline

2026-09-09 - CVE-2026-80124 published to NVD
2026-09-09 - Dell published security advisory DSA-2026-382
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-80124

Vulnerability Analysis

Dell Secure Connect Gateway is a communication service that enables Dell support infrastructure to interact with monitored devices for telemetry, alerting, and remote assistance. The affected SCG components write sensitive information into log files during normal operation. Any user account with local access to the appliance and read permissions on those logs can retrieve the exposed data. The vulnerability is categorized under [CWE-532] and requires local access along with low-level privileges, with no user interaction needed.

Root Cause

The root cause is improper handling of sensitive fields during log generation. Application components record diagnostic or operational data that should be redacted, masked, or excluded before being written to persistent log files. Because log files typically inherit permissive access controls to allow support engineers and local service accounts to review them, information that should remain confidential becomes accessible to any authenticated local user.

Attack Vector

Exploitation requires local access to the SCG appliance and any authenticated account with permission to read log files. An attacker with shell access, a service account, or a compromised low-privilege user can enumerate log directories used by the SCG application and parse them for credentials, tokens, configuration details, or other operational data. No network access, no elevated privileges, and no user interaction are required. Impact is limited to confidentiality; integrity and availability are not affected.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Dell Security Update DSA-2026-382 for vendor-supplied technical details.

Detection Methods for CVE-2026-80124

Indicators of Compromise

Unexpected read access to SCG log directories by non-administrative local accounts.
Log file copy or exfiltration events involving SCG application log paths.
Presence of clear-text credentials, session tokens, or API keys within SCG log files.

Detection Strategies

Audit the contents of SCG log files after upgrade to identify sensitive fields that may have been previously exposed.
Correlate local shell sessions on the SCG appliance with access to log files outside expected support workflows.
Deploy file integrity monitoring on SCG log directories to alert on unusual read patterns from non-service accounts.

Monitoring Recommendations

Forward SCG operating system audit logs to a centralized SIEM for retention and correlation.
Track privileged and semi-privileged local account activity on the SCG appliance, including sudo usage and file access.
Rotate any credentials or secrets that may have appeared in historical SCG logs after patching.

How to Mitigate CVE-2026-80124

Immediate Actions Required

Upgrade Dell SCG 5.0 Appliance to version 5.36.00.16 or later.
Upgrade Dell SCG 5.0 Application to version 5.36.00.00 or later.
Review and restrict local user accounts on the SCG appliance to the minimum required for operations.
Purge or rotate historical log files that may contain sensitive information following patch installation.

Patch Information

Dell released fixes in SCG 5.0 Appliance 5.36.00.16 and SCG 5.0 Application 5.36.00.00. Administrators should follow the upgrade procedure documented in the Dell Security Update DSA-2026-382 advisory. Verify the installed version through the SCG management console after applying the update.

Workarounds

Restrict local and console access to the SCG appliance to authorized administrators only.
Tighten file system permissions on SCG log directories to prevent read access by non-privileged accounts.
Route SCG logs to a protected remote log server with strict access controls until patching is complete.

bash

# Configuration example
# Refer to Dell advisory DSA-2026-382 for vendor-supplied remediation steps.
# Verify installed SCG version after upgrade:
#   Appliance target version: 5.36.00.16 or later
#   Application target version: 5.36.00.00 or later