CVE-2026-80130: Dell Secure Connect Gateway Path Traversal

CVE-2026-80130 Overview

CVE-2026-80130 is a relative path traversal vulnerability [CWE-23] affecting Dell Secure Connect Gateway (SCG) 5.0. The flaw impacts both the SCG 5.0 Appliance and the SCG 5.0 Application prior to their respective fixed builds. A remote, authenticated attacker with low privileges can traverse the file system outside the intended directory scope. Successful exploitation can lead to remote code execution on the affected gateway. Dell published fixes and technical details in security advisory DSA-2026-382.

Critical Impact
A low-privileged remote attacker can leverage path traversal to achieve remote code execution on the Secure Connect Gateway, compromising confidentiality, integrity, and availability of the appliance.

Affected Products

Dell Secure Connect Gateway 5.0 Appliance versions prior to 5.36.00.16
Dell Secure Connect Gateway 5.0 Application versions prior to 5.36.00.00
Dell Secure Connect Gateway Virtual Edition (per Dell advisory DSA-2026-382)

Discovery Timeline

2026-09-07 - CVE-2026-80130 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-80130

Vulnerability Analysis

Dell Secure Connect Gateway is a remote support and telemetry gateway that connects Dell infrastructure to Dell support services. The affected 5.0 releases process user-supplied path input without adequately constraining it to a permitted base directory. An authenticated attacker with low privileges can submit crafted relative path sequences to reach files and directories outside the intended scope. Because the gateway service runs with elevated privileges on the appliance, path traversal in a file-handling code path can be chained into remote code execution. The vulnerability is exploitable over the network without user interaction, according to the vector published by Dell.

Root Cause

The root cause is improper neutralization of relative path elements such as ../ in file path inputs, classified under [CWE-23] Relative Path Traversal. The application resolves attacker-influenced path components before verifying that the canonical result stays within an approved directory. This allows references to arbitrary file system locations that the SCG process can read from or write to.

Attack Vector

Exploitation requires network access to the Secure Connect Gateway management surface and a low-privileged account on the appliance. The attacker submits a request containing traversal sequences targeting a file-handling endpoint. By writing to a location that is later loaded or executed by a privileged component, the attacker can achieve code execution in the gateway context. No user interaction is required. Detailed exploitation mechanics have not been published by Dell, and no public proof-of-concept is available as of publication. See the Dell Security Update DSA-2026-382 for vendor guidance.

Detection Methods for CVE-2026-80130

Indicators of Compromise

HTTP requests to SCG management endpoints containing ../, ..\\, URL-encoded %2e%2e%2f, or double-encoded traversal sequences in path or file parameters.
Unexpected file creation or modification outside standard SCG application directories on the appliance.
New or modified scripts, cron entries, or service unit files under paths writable only by the SCG service account.
Outbound network connections from the SCG appliance to non-Dell infrastructure following suspicious authenticated sessions.

Detection Strategies

Inspect SCG application and web server logs for authenticated requests containing traversal patterns and correlate them with low-privileged accounts.
Baseline the SCG appliance file system and alert on writes outside expected application directories.
Monitor SCG process ancestry for shell interpreters, scripting engines, or reverse-shell utilities spawned from the gateway service.

Monitoring Recommendations

Forward SCG appliance logs, authentication events, and process telemetry to a centralized analytics platform for retention and correlation.
Alert on successful authentications by low-privileged SCG accounts from unexpected source networks.
Track version and patch state of every SCG instance to confirm fixed builds are deployed.

How to Mitigate CVE-2026-80130

Immediate Actions Required

Upgrade Dell SCG 5.0 Appliance to version 5.36.00.16 or later.
Upgrade Dell SCG 5.0 Application to version 5.36.00.00 or later.
Review and rotate credentials for all low-privileged SCG accounts that could be abused for authenticated access.
Restrict management-plane access to the SCG appliance to trusted administrative networks only.

Patch Information

Dell has released fixed builds documented in Dell Security Update DSA-2026-382. Administrators should apply the vendor-supplied update for each deployment model (Appliance or Application) and confirm the running version matches or exceeds the fixed release after upgrade.

Workarounds

No vendor-supplied workaround is documented; apply the Dell update as the primary remediation.
Place the SCG management interface behind network access controls that limit reachability to authorized administrators.
Audit and remove unused low-privileged accounts on the appliance to reduce the authenticated attack surface.

bash

# Verify installed Dell SCG version before and after patching
# Replace <scg-host> with your appliance address
ssh admin@<scg-host> "scg-cli version"
# Expected output after patch:
#   Appliance:   5.36.00.16 (or later)
#   Application: 5.36.00.00 (or later)