CVE-2026-80167: Dell SCG Information Disclosure Vulnerability

CVE-2026-80167 Overview

CVE-2026-80167 is a hard-coded cryptographic key vulnerability [CWE-321] in Dell Secure Connect Gateway (SCG) 5.0. The flaw affects Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00. A low-privileged local attacker can extract the embedded key and use it to decrypt protected data. Successful exploitation leads to information disclosure without affecting integrity or availability.

Critical Impact
A local attacker with low privileges can recover the hard-coded cryptographic key and decrypt sensitive data protected by it, resulting in confidentiality loss on affected Dell SCG 5.0 deployments.

Affected Products

Dell Secure Connect Gateway (SCG) 5.0 Appliance versions prior to 5.36.00.16
Dell Secure Connect Gateway (SCG) 5.0 Application versions prior to 5.36.00.00
Dell SCG Virtual Edition deployments referenced in DSA-2026-382

Discovery Timeline

2026-09-07 - CVE-2026-80167 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-80167

Vulnerability Analysis

Dell Secure Connect Gateway (SCG) is a remote support and telemetry appliance that securely relays device data between customer environments and Dell support infrastructure. CVE-2026-80167 stems from the use of a hard-coded cryptographic key inside the SCG 5.0 codebase. Because the key ships with the product, every deployment shares the same secret material.

An attacker with local, low-privileged access to the appliance can locate the embedded key through filesystem inspection or binary analysis. Once recovered, the key can be reused to decrypt any data protected by that key across affected installations. The advisory scope limits impact to confidentiality; the vulnerability does not permit tampering or service disruption on its own.

Root Cause

The root cause is the embedding of a static cryptographic key within the product distribution [CWE-321]. Hard-coded keys cannot be rotated by administrators, and their exposure through decompilation or filesystem access effectively removes the cryptographic protection they were intended to provide. Any secrets, tokens, or credentials encrypted with this key on affected SCG versions must be treated as recoverable by anyone who has obtained the shared key.

Attack Vector

Exploitation requires local access to an affected Dell SCG 5.0 Appliance or Application instance with at least low-privilege credentials. No user interaction is required. The attacker reads the key from disk or memory, then decrypts targeted ciphertext to reveal protected values. See the Dell Security Update DSA-2026-382 for vendor-provided technical scope.

// No verified public proof-of-concept is available.
// Refer to Dell Security Advisory DSA-2026-382 for technical details.

Detection Methods for CVE-2026-80167

Indicators of Compromise

Unexpected local shell sessions or file reads targeting SCG configuration or key-storage paths on the appliance
Access to encrypted configuration files by accounts that do not normally interact with SCG cryptographic material
Presence of decrypted secrets, credentials, or tokens outside their normal storage locations on the SCG host

Detection Strategies

Audit local login activity on SCG 5.0 Appliance and Application hosts, focusing on low-privileged accounts performing file enumeration
Compare installed SCG build numbers against the fixed versions 5.36.00.16 (Appliance) and 5.36.00.00 (Application) to identify exposed instances
Review host-based logs for binary or filesystem inspection tools such as strings, grep, or debuggers executing against SCG components

Monitoring Recommendations

Forward SCG operating system, authentication, and file-access logs to a centralized analytics platform for correlation
Alert on privilege changes, new local accounts, or sudo escalations on SCG hosts
Track outbound connections from SCG appliances for signs of exfiltrated secrets recovered via the hard-coded key

How to Mitigate CVE-2026-80167

Immediate Actions Required

Upgrade Dell SCG 5.0 Appliance to version 5.36.00.16 or later and Dell SCG 5.0 Application to 5.36.00.00 or later
Restrict local access to SCG hosts to a minimal set of trusted administrators and enforce strong authentication
Rotate credentials, tokens, and integration secrets that were stored or processed by SCG under the affected versions

Patch Information

Dell has released fixed builds documented in Dell Security Update DSA-2026-382. Apply Dell SCG 5.0 Appliance 5.36.00.16 or later and Dell SCG 5.0 Application 5.36.00.00 or later. Verify version strings post-upgrade and confirm that any previously stored encrypted data has been re-encrypted under keys generated after the patch.

Workarounds

No vendor-supplied workaround replaces the patch; upgrading to the fixed release is required
Reduce exposure by isolating SCG management interfaces on a dedicated administrative network segment
Remove interactive shell access for non-essential accounts and enforce least-privilege role assignments on the appliance

bash

# Verify installed Dell SCG version against the fixed release
scg-cli show version
# Expected output should be >= 5.36.00.16 (Appliance) or >= 5.36.00.00 (Application)