CVE-2026-80133: Dell SCG 5.0 Path Traversal Vulnerability

CVE-2026-80133 Overview

CVE-2026-80133 is a relative path traversal vulnerability affecting Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application editions. The flaw resides in path-handling logic that fails to sanitize user-controlled input containing directory traversal sequences. An unauthenticated remote attacker can exploit this weakness to access files outside the intended directory and, according to Dell's advisory, achieve remote code execution on the target system. The vulnerability is tracked under [CWE-23: Relative Path Traversal].

Critical Impact
Unauthenticated remote attackers can traverse the file system and execute code on Dell SCG appliances running vulnerable versions.

Affected Products

Dell SCG 5.0 Appliance versions prior to 5.36.00.16
Dell SCG 5.0 Application versions prior to 5.36.00.00
Dell Secure Connect Gateway Virtual Edition

Discovery Timeline

2026-09-07 - CVE-2026-80133 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-80133

Vulnerability Analysis

Dell Secure Connect Gateway (SCG) is a support-automation appliance that brokers connections between customer infrastructure and Dell's remote support services. The vulnerability exists in request-handling components that construct file paths from attacker-controlled input without properly normalizing traversal sequences such as ../.

Because the affected endpoints do not require authentication, a remote attacker can reach the vulnerable code path over the network. Dell's advisory indicates that successful exploitation can lead to remote code execution, extending the impact beyond arbitrary file read into full compromise of the appliance. The attack complexity is elevated, which suggests specific timing, encoding, or configuration conditions must be met to achieve reliable exploitation.

Root Cause

The underlying defect is improper input validation on path components processed by the SCG service. The application accepts input containing relative traversal sequences and resolves them against a base directory without enforcing a canonical path check. This allows references to files and directories outside the intended scope, and in combination with writable or executable locations, enables code execution.

Attack Vector

Exploitation occurs over the network against an exposed SCG service endpoint. No credentials or user interaction are required. The attacker crafts a request containing traversal sequences targeting sensitive files or writable locations on the appliance. Refer to the Dell Security Update DSA-2026-382 for vendor-supplied technical details.

No public proof-of-concept exploit code has been released for CVE-2026-80133 at the time of publication.

Detection Methods for CVE-2026-80133

Indicators of Compromise

HTTP or API requests to Dell SCG endpoints containing encoded or plain traversal sequences such as ../, ..%2f, or %2e%2e%2f.
Unexpected file access on the SCG appliance targeting configuration files, credential stores, or system binaries.
New or modified files in web-accessible directories on the appliance that were not deployed by Dell update packages.
Outbound network connections from the SCG appliance to unfamiliar hosts following anomalous inbound requests.

Detection Strategies

Inspect web server and application logs on SCG appliances for request URIs containing traversal patterns targeting file paths.
Correlate inbound requests to SCG management interfaces with subsequent process creation events on the appliance.
Alert on any process spawned by the SCG service account that is not part of documented Dell operations.

Monitoring Recommendations

Restrict management-plane exposure of SCG appliances and monitor network flows to the service from outside management subnets.
Enable verbose HTTP access logging on the SCG appliance and forward logs to a centralized SIEM for retention and analysis.
Baseline expected file system state on the appliance and flag additions to writable web directories.

How to Mitigate CVE-2026-80133

Immediate Actions Required

Upgrade Dell SCG 5.0 Appliance to version 5.36.00.16 or later.
Upgrade Dell SCG 5.0 Application to version 5.36.00.00 or later.
Restrict network access to SCG management interfaces to trusted administrative networks only.
Review appliance logs for evidence of exploitation attempts prior to patch deployment.

Patch Information

Dell has released fixed builds addressed in Dell Security Update DSA-2026-382. Administrators should apply the update through the standard SCG upgrade process and verify the running version after reboot.

Workarounds

Place SCG appliances behind a network firewall or reverse proxy that filters URIs containing traversal sequences.
Limit inbound access to SCG service ports using network access control lists until patches are applied.
Disable or block external access to any non-essential SCG endpoints during the remediation window.

bash

# Verify SCG appliance version after upgrade
# Replace with actual administrative command per Dell documentation
scg-cli show version