CVE-2026-80175: Dell Secure Connect Gateway Info Disclosure

CVE-2026-80175 Overview

CVE-2026-80175 affects Dell Secure Connect Gateway (SCG) 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00. The flaw is classified as Insertion of Sensitive Information into Externally-Accessible File or Directory [CWE-538]. A low-privileged attacker with local access to the appliance can read sensitive data that should not be exposed to standard users. Successful exploitation results in information disclosure without impacting integrity or availability of the gateway.

Critical Impact
Local low-privileged users can access sensitive information stored in externally-accessible files on Dell Secure Connect Gateway 5.0.

Affected Products

Dell Secure Connect Gateway 5.0 Appliance versions prior to 5.36.00.16
Dell Secure Connect Gateway 5.0 Application versions prior to 5.36.00.00
Dell Secure Connect Gateway Virtual Edition

Discovery Timeline

2026-09-09 - CVE CVE-2026-80175 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-80175

Vulnerability Analysis

CVE-2026-80175 is an information disclosure issue in Dell Secure Connect Gateway 5.0. The product writes sensitive information into files or directories that are readable by users beyond the intended audience. Any authenticated user on the appliance can read this data using standard filesystem operations. The exposure does not require elevated privileges, exploitation tooling, or user interaction beyond local access to the system.

Dell's advisory DSA-2026-382 addresses this issue alongside other vulnerabilities affecting the Secure Connect Gateway Virtual Edition. No public proof-of-concept is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is improper access control on files or directories that contain sensitive data. Under CWE-538, the application places information such as configuration data, credentials, tokens, or diagnostic output into locations where the filesystem permissions or path exposure allow low-privileged accounts to read them. The product does not restrict the accessible path or apply appropriate ownership and mode bits to the sensitive artifacts.

Attack Vector

An attacker requires local access to the Dell SCG appliance with a low-privileged account. The attacker enumerates readable paths under the SCG installation, log, or configuration directories and extracts sensitive content. No network access, user interaction, or authentication bypass is required beyond the initial local session. The disclosed information can support follow-on attacks against integrated Dell service infrastructure or systems that depend on SCG for secure connectivity.

No verified exploitation code is publicly available. Refer to the Dell Security Update DSA-2026-382 for vendor technical details.

Detection Methods for CVE-2026-80175

Indicators of Compromise

Unexpected read access to SCG configuration, log, or backup files by non-administrative local accounts.
Shell history entries showing cat, less, cp, or tar operations against SCG data directories by low-privileged users.
Outbound transfers of SCG configuration artifacts to unusual destinations following local shell activity.

Detection Strategies

Audit filesystem permissions on all SCG 5.0 directories and flag world-readable files containing configuration or credential material.
Deploy auditd or equivalent file integrity monitoring on SCG data paths to record read events from non-service accounts.
Correlate local logon events with subsequent file access patterns targeting SCG installation directories.

Monitoring Recommendations

Forward SCG appliance audit logs and shell session telemetry to a centralized SIEM for review.
Alert on any interactive login by accounts that should only run automated tasks against the gateway.
Track the running version of SCG and confirm all instances report 5.36.00.16 or later for appliance deployments.

How to Mitigate CVE-2026-80175

Immediate Actions Required

Upgrade Dell SCG 5.0 Appliance to version 5.36.00.16 or later.
Upgrade Dell SCG 5.0 Application to version 5.36.00.00 or later.
Review and revoke any credentials, tokens, or keys that were stored on the appliance and may have been exposed.
Restrict local shell access on SCG appliances to administrators only.

Patch Information

Dell released fixed versions in advisory DSA-2026-382. Apply the update from the Dell Security Update DSA-2026-382 using the standard SCG upgrade procedure. Verify the running version after upgrade and confirm the appliance reports the patched build.

Workarounds

Limit local user accounts on the SCG appliance to trusted administrators until the patch is applied.
Enforce filesystem monitoring on SCG configuration and log directories to detect unauthorized read operations.
Rotate any secrets that the appliance stored locally after confirming the upgrade completed successfully.

bash

# Verify the installed Dell SCG version after upgrade
# Replace with the vendor-documented command for your deployment
cat /opt/dell/secureconnectgateway/version.txt