CVE-2026-80174: Dell Secure Connect Gateway Auth Bypass

CVE-2026-80174 Overview

CVE-2026-80174 is an Insufficient Session Expiration vulnerability [CWE-613] affecting Dell Secure Connect Gateway (SCG) 5.0. The flaw exists in Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00. A remote, low-privileged attacker can abuse the weakness to reuse a session identifier that should have expired, leading to session theft and unauthorized access to the affected account.

Critical Impact
A remote, authenticated attacker can hijack an active user session on Dell SCG, gaining access to sensitive gateway data and functionality tied to the compromised account.

Affected Products

Dell Secure Connect Gateway 5.0 Appliance versions prior to 5.36.00.16
Dell Secure Connect Gateway 5.0 Application versions prior to 5.36.00.00
Dell SCG Virtual Edition (per vendor advisory DSA-2026-382)

Discovery Timeline

2026-09-09 - CVE CVE-2026-80174 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-80174

Vulnerability Analysis

Dell Secure Connect Gateway is Dell's remote support and telemetry gateway used to connect enterprise infrastructure to Dell Technologies services. The vulnerability lies in how the SCG web management interface manages authenticated session lifetimes. Session tokens issued to authenticated users remain valid beyond the expected expiration window, giving an attacker with knowledge of a stale or captured token continued access to the user's session context.

Exploitation requires network reachability to the SCG management interface and pre-existing low privileges to obtain or observe session material. Because confidentiality impact is high while integrity and availability are unaffected, the primary risk is unauthorized read access to gateway data, device telemetry, and support connection metadata handled by SCG.

Root Cause

The root cause is a failure to enforce timely invalidation of authenticated session identifiers, categorized as [CWE-613] Insufficient Session Expiration. Sessions that should be terminated after logout, inactivity, or a fixed maximum lifetime continue to be accepted by the server, breaking a core session-management security control.

Attack Vector

The attack vector is network-based and requires low privileges without user interaction, though attack complexity is high. A plausible exploitation path involves an attacker capturing a session identifier through a shared workstation, browser artifact, proxy log, or prior credential exposure. The attacker then replays the token against the SCG interface after the legitimate user believes the session has ended, obtaining access under that user's identity.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Dell Security Update Advisory for vendor technical details.

Detection Methods for CVE-2026-80174

Indicators of Compromise

Reuse of the same SCG session cookie or token from multiple source IP addresses or user-agent strings within a short window.
SCG authenticated activity occurring after a documented user logout or well past configured idle-timeout thresholds.
Access to SCG administrative endpoints from geolocations or networks inconsistent with the assigned user's normal behavior.

Detection Strategies

Correlate SCG web server access logs with authentication events to identify sessions that remain active beyond expected lifetimes.
Alert on session identifiers observed across differing client fingerprints, such as user agent, TLS JA3, or source ASN.
Baseline typical SCG session duration per account and flag statistical outliers for review.

Monitoring Recommendations

Forward SCG appliance and application logs to a centralized SIEM for retention and correlation.
Enable verbose authentication and session-lifecycle logging on the SCG management interface.
Monitor administrative configuration changes on SCG for unexpected modifications following suspicious session activity.

How to Mitigate CVE-2026-80174

Immediate Actions Required

Upgrade Dell SCG 5.0 Appliance to version 5.36.00.16 or later, and Dell SCG 5.0 Application to 5.36.00.00 or later.
Force logout of all active SCG sessions after upgrade to invalidate any tokens issued by the vulnerable build.
Rotate credentials for any SCG accounts suspected of exposure, especially privileged administrative accounts.
Restrict network access to the SCG management interface to trusted administrative networks only.

Patch Information

Dell has released fixed versions addressing CVE-2026-80174. Administrators should apply the updates documented in the Dell Security Update Advisory DSA-2026-382. The advisory covers Dell SCG Virtual Edition and lists the minimum fixed appliance and application versions.

Workarounds

Place the SCG management interface behind a VPN or bastion host to reduce remote exposure until patching is complete.
Reduce configured session idle and absolute timeout values to the lowest operationally acceptable settings.
Require administrators to explicitly log out and close browser sessions after use, avoiding shared or unmanaged endpoints.

bash

# Example: verify installed Dell SCG version prior to and after patching
cat /opt/dell/scg/version.txt

# Expected fixed versions:
#   Appliance : 5.36.00.16 or later
#   Application: 5.36.00.00 or later