CVE-2026-80170: Dell SCG 5.0 Authentication Bypass Vulnerability

CVE-2026-80170 Overview

CVE-2026-80170 is a hard-coded credentials vulnerability [CWE-798] in Dell Secure Connect Gateway (SCG) 5.0. The flaw affects SCG 5.0 Appliance versions prior to 5.36.00.16 and SCG 5.0 Application versions prior to 5.36.00.00. An authenticated remote attacker can leverage embedded credentials to bypass protection mechanisms and access confidential data. Dell disclosed the issue in security advisory DSA-2026-382.

Critical Impact
An attacker with network access and low privileges can use hard-coded credentials to bypass authentication controls and access sensitive information on the appliance.

Affected Products

Dell Secure Connect Gateway 5.0 Appliance versions prior to 5.36.00.16
Dell Secure Connect Gateway 5.0 Application versions prior to 5.36.00.00
Dell Secure Connect Gateway Virtual Edition

Discovery Timeline

2026-09-07 - CVE-2026-80170 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-80170

Vulnerability Analysis

Dell Secure Connect Gateway provides remote support connectivity between Dell infrastructure and Dell's support systems. The vulnerability stems from embedded credentials shipped inside the SCG 5.0 Appliance and Application distributions. These credentials exist in the deployed image rather than being generated per installation.

An attacker who obtains or reverse-engineers the static credentials can authenticate against the appliance without operator-issued accounts. The impact is scoped to confidentiality, allowing disclosure of sensitive data managed by the gateway. Integrity and availability are not directly affected according to the advisory.

Root Cause

The root cause is the presence of hard-coded credentials [CWE-798] baked into the SCG 5.0 software distribution. Static secrets in shipped software cannot be rotated by operators and are identical across every deployment of the same build. Once the credentials are extracted from one instance, every unpatched appliance becomes accessible.

Attack Vector

Exploitation requires network reachability to the SCG management or service interface. The attacker submits the embedded credentials to the exposed authentication endpoint. Successful authentication grants access at the privilege level associated with the embedded account, enabling the protection mechanism bypass described by Dell.

No public proof-of-concept is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability at publication is 0.22%.

See the Dell Security Update DSA-2026-382 for vendor technical details.

Detection Methods for CVE-2026-80170

Indicators of Compromise

Successful authentication events on SCG management interfaces from unexpected source IP addresses or outside change windows.
Repeated login attempts against SCG service ports originating from external or non-administrative network segments.
Configuration or data export activity on the SCG appliance that does not correlate to a known administrator session.

Detection Strategies

Inventory all Dell SCG 5.0 Appliance and Application instances and record their build numbers to identify versions below 5.36.00.16 and 5.36.00.00.
Correlate authentication logs from SCG with source-IP allowlists and alert on any account use from unapproved networks.
Deploy network intrusion detection signatures for anomalous authentication traffic targeting SCG management endpoints.

Monitoring Recommendations

Forward SCG appliance authentication and audit logs to a centralized SIEM for retention and correlation.
Alert on privileged operations performed outside scheduled maintenance windows.
Monitor egress traffic from SCG appliances for unexpected destinations or data volumes.

How to Mitigate CVE-2026-80170

Immediate Actions Required

Upgrade Dell SCG 5.0 Appliance to version 5.36.00.16 or later and SCG 5.0 Application to version 5.36.00.00 or later.
Restrict network access to the SCG management interface to a small set of trusted administrative networks.
Review authentication logs for anomalous logins predating the patch deployment.

Patch Information

Dell has released fixed builds referenced in Dell Security Update DSA-2026-382. Apply the update for both the Appliance and Application components. Verify the running build number after the upgrade to confirm remediation.

Workarounds

Place the SCG appliance behind a firewall that limits inbound traffic to Dell support endpoints and authorized administrators only.
Enforce network segmentation so the SCG appliance cannot be reached from general user or guest networks.
Rotate any credentials, tokens, or API keys stored on the SCG appliance after patching to invalidate material that may have been exposed.

bash

# Configuration example: restrict inbound access to SCG management interface
# Replace <admin_subnet> and <scg_ip> with environment values
iptables -A INPUT -p tcp -s <admin_subnet> -d <scg_ip> --dport 443 -j ACCEPT
iptables -A INPUT -p tcp -d <scg_ip> --dport 443 -j DROP