CVE-2026-80129: Dell Secure Connect Gateway Path Traversal

CVE-2026-80129 Overview

CVE-2026-80129 is a path traversal vulnerability in Dell Secure Connect Gateway (SCG) 5.0 that allows unauthenticated remote code execution. The flaw affects Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00. An attacker with network access can traverse outside the intended directory scope and reach files or execution primitives that should remain restricted. Dell tracks the issue under advisory DSA-2026-382. The weakness maps to [CWE-22], Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Unauthenticated remote attackers can exploit path traversal to achieve remote code execution on affected Dell SCG 5.0 systems.

Affected Products

Dell Secure Connect Gateway 5.0 Appliance versions prior to 5.36.00.16
Dell Secure Connect Gateway 5.0 Application versions prior to 5.36.00.00
Dell SCG Virtual Edition (per DSA-2026-382)

Discovery Timeline

2026-09-07 - CVE-2026-80129 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-80129

Vulnerability Analysis

Dell Secure Connect Gateway is the remote support and telemetry gateway that connects Dell infrastructure to Dell backend services. The vulnerability lets a remote, unauthenticated attacker submit crafted input containing directory traversal sequences to a network-accessible service. Because the application does not properly canonicalize or restrict pathnames, the attacker can reference files outside the intended directory. Dell's advisory states that successful exploitation can lead to remote code execution, indicating the traversal reaches a write or execution primitive rather than a read-only file lookup. The attack requires no user interaction and no prior privileges on the target.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory ([CWE-22]). Input containing traversal sequences such as ../ is not normalized before being used in file operations. This allows references to resolve outside the intended base directory. Combined with a downstream sink that writes or executes file content, the flaw escalates from file access to code execution.

Attack Vector

The attack is delivered over the network against the SCG management or communication interface. No authentication, credentials, or user interaction are required. An attacker crafts a request containing directory traversal sequences targeting a vulnerable endpoint. The server resolves the manipulated path and processes attacker-controlled data at a location that grants code execution, yielding full compromise of confidentiality, integrity, and availability.

No public proof-of-concept exploit is available at time of publication. Refer to the Dell Security Advisory DSA-2026-382 for vendor-specific technical detail.

Detection Methods for CVE-2026-80129

Indicators of Compromise

HTTP requests to SCG endpoints containing directory traversal sequences such as ../, ..%2f, ..%5c, or double-encoded variants.
New or modified files in SCG web-accessible directories, particularly executable scripts or JSP/PHP-style handlers not present in a known-good baseline.
Unexpected child processes spawned by the SCG service account, especially shells, interpreters, or network utilities.
Outbound connections from the SCG appliance to unfamiliar external hosts following anomalous inbound traffic.

Detection Strategies

Inspect web server and reverse proxy logs for URL-decoded path segments that resolve outside the SCG application root.
Baseline the SCG filesystem and alert on additions or modifications in upload, temp, or webroot directories.
Correlate inbound HTTP anomalies with process-execution telemetry from the SCG host to catch traversal followed by command execution.
Deploy signatures on network security tooling that flag encoded traversal payloads targeting SCG management ports.

Monitoring Recommendations

Enable verbose access logging on the SCG appliance and forward logs to a centralized platform for retention and search.
Monitor authentication and administrative activity for anomalies that may follow a successful traversal-based compromise.
Track outbound network flows from SCG hosts and alert on connections outside the documented Dell backend destinations.

How to Mitigate CVE-2026-80129

Immediate Actions Required

Upgrade Dell SCG 5.0 Appliance to version 5.36.00.16 or later, and Dell SCG 5.0 Application to 5.36.00.00 or later.
Restrict network access to SCG management interfaces to trusted administrative networks only, using firewall or segmentation controls.
Review SCG hosts for evidence of prior exploitation, focusing on unexpected files, processes, and outbound connections.
Rotate credentials, API tokens, and certificates associated with any SCG instance suspected of compromise.

Patch Information

Dell has released fixed builds addressed in Dell Security Advisory DSA-2026-382. Apply Appliance version 5.36.00.16 or later and Application version 5.36.00.00 or later. Follow Dell's documented upgrade procedure for the SCG Virtual Edition and validate service health post-upgrade.

Workarounds

No vendor-supplied workaround replaces patching. Apply the fixed versions as the primary remediation.
Place the SCG appliance behind a web application firewall configured to block URL-encoded and double-encoded traversal patterns.
Enforce strict network access control lists so only required Dell backend endpoints and administrator jump hosts can reach the SCG service.
Increase logging verbosity and forward events to a SIEM to shorten detection time until the patch is deployed.

bash

# Example WAF/ACL guidance (adapt to your environment)
# 1) Restrict management access to admin subnet only
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# 2) Block common traversal patterns at the reverse proxy (nginx example)
# location / {
#     if ($request_uri ~* "(\.\./|\.\.%2f|\.\.%5c|%2e%2e%2f)") {
#         return 403;
#     }
# }