CVE-2026-80171: Dell Secure Connect Gateway Privilege Escalation

CVE-2026-80171 Overview

CVE-2026-80171 is an Insufficient Entropy in Pseudo-Random Number Generator (PRNG) vulnerability [CWE-331] affecting Dell Secure Connect Gateway (SCG) 5.0. The flaw exists in Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00. A low-privileged attacker with local access to the appliance can predict PRNG output and use that predictability to escalate privileges on the host.

Critical Impact
A local, low-privileged attacker can exploit weak randomness in Dell SCG to elevate privileges, gaining control over an appliance used to broker support connectivity between Dell infrastructure and customer environments.

Affected Products

Dell Secure Connect Gateway 5.0 Appliance versions prior to 5.36.00.16
Dell Secure Connect Gateway 5.0 Application versions prior to 5.36.00.00
Dell Secure Connect Gateway Virtual Edition (per DSA-2026-382)

Discovery Timeline

2026-09-09 - CVE-2026-80171 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-80171

Vulnerability Analysis

Dell Secure Connect Gateway brokers secure remote support connectivity between Dell back-end services and customer infrastructure. The vulnerability stems from the appliance generating pseudo-random values with insufficient entropy. Values produced by the affected PRNG are predictable to an attacker who can observe or reason about the generator state.

When such values are used for security-sensitive purposes, for example tokens, session identifiers, temporary credentials, or key material, an attacker who predicts them can impersonate a higher-privileged principal. The result is an elevation of privileges from a local, low-privileged account to a more privileged context on the appliance.

Exploitation requires local access and high attack complexity, which reflects the need for the attacker to already hold an account on the appliance and to successfully model or brute-force the weak PRNG output within a viable window.

Root Cause

The root cause is classified as CWE-331 (Insufficient Entropy). A PRNG within the Dell SCG stack is seeded or constructed in a way that does not provide adequate unpredictability for security use. Predictable outputs undermine any downstream control that assumes randomness, such as authentication tokens or key derivation inputs.

Attack Vector

The attack vector is local. An authenticated low-privileged actor on the appliance leverages predictable PRNG output to derive or guess a value that grants access to a higher-privileged function or identity. No user interaction is required. Confidentiality impact is high, while integrity and availability are not directly impacted per the CVSS vector.

No public proof-of-concept exploit, ExploitDB entry, or CISA KEV listing is associated with CVE-2026-80171 at time of publication. Dell has published remediation guidance in advisory DSA-2026-382.

See the Dell Security Update DSA-2026-382 for full technical details.

Detection Methods for CVE-2026-80171

Indicators of Compromise

Unexpected privilege transitions on the SCG appliance, such as a low-privileged service account performing administrative operations.
Repeated authentication or token validation attempts from a local account within a short time window, consistent with brute-forcing predictable values.
Configuration or credential changes on the appliance outside of scheduled maintenance windows.

Detection Strategies

Inventory Dell SCG deployments and confirm running versions against the fixed builds 5.36.00.16 (Appliance) and 5.36.00.00 (Application).
Review appliance audit logs for privilege escalation events and correlate with local user session activity.
Alert on new administrative sessions originating from accounts that historically only perform read-only or telemetry operations.

Monitoring Recommendations

Forward Dell SCG system and audit logs to a centralized logging or SIEM platform for retention and correlation.
Monitor network egress from SCG appliances for anomalous destinations that could indicate post-exploitation activity.
Track configuration drift on SCG virtual appliances using file integrity or configuration baseline tooling.

How to Mitigate CVE-2026-80171

Immediate Actions Required

Upgrade Dell SCG 5.0 Appliance to version 5.36.00.16 or later.
Upgrade Dell SCG 5.0 Application to version 5.36.00.00 or later.
Restrict local and management-plane access to the SCG appliance to a minimal set of administrators.
Rotate any credentials, tokens, or keys that may have been generated by the vulnerable PRNG after patching.

Patch Information

Dell has released fixed versions in advisory DSA-2026-382. Apply Dell SCG 5.0 Appliance 5.36.00.16 or Dell SCG 5.0 Application 5.36.00.00 per the Dell Security Update DSA-2026-382. Follow Dell's documented upgrade procedure for virtual and application deployments.

Workarounds

Limit local shell and console access on the SCG appliance to trusted administrators only.
Enforce role-based access control so that low-privileged accounts cannot reach interfaces that consume PRNG-derived values.
Segment SCG appliances on a management VLAN with strict inbound and outbound access control lists until patching is complete.

bash

# Verify Dell SCG version before and after upgrade
# Example: check installed SCG package version on the appliance
rpm -qa | grep -i scg

# Confirm the running version meets or exceeds the fixed build
# Appliance: 5.36.00.16 or later
# Application: 5.36.00.00 or later