Description
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.
Published: 2026-09-29
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Server‑Side Request Forgery via open redirect
Action: Patch Immediately
AI Analysis

Impact

The vulnerability is a URL redirection to an untrusted site in the Dell Secure Connect Gateway Policy Manager, allowing attackers to configure untrusted destinations and causing the server to make requests to those addresses. This enables Server‑Side Request Forgery, where the attacker can make the protected system request internal resources or exfiltrate sensitive data through the forged request. The weakness follows CWE‑601.

Affected Systems

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate risk, and the absence of an EPSS score and KEV listing imply limited exploitation activity. The attack vector is likely remote access to the SCG web interface without authentication, where the attacker can supply a crafted URL that the system then redirects to an untrusted site, enabling Server‑Side Request Forgery.

Generated by OpenCVE AI on September 30, 2026 at 03:34 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Download and install Dell Secure Connect Gateway Policy Manager update 5.34.00.16 or newer, which removes the vulnerable redirect logic.
  • If a patch cannot be applied immediately, disable the URL redirection feature or block outbound connections to external domains from the SCG using firewall or ACL rules.
  • Conduct a security review of the SCG configuration to confirm that the device can no longer resolve untrusted URLs or perform unauthorized redirects.

Generated by OpenCVE AI on September 30, 2026 at 03:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Dell policy Manager For Secure Connect Gateway
CPEs cpe:2.3:a:dell:policy_manager_for_secure_connect_gateway:*:*:*:*:*:*:*:*
Vendors & Products Dell policy Manager For Secure Connect Gateway

Wed, 30 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Dell
Dell secure Connect Gateway Policy Manager
Vendors & Products Dell
Dell secure Connect Gateway Policy Manager

Wed, 30 Sep 2026 04:00:00 +0000

Type Values Removed Values Added
Title Open Redirect in Dell Secure Connect Gateway Policy Manager Enables Server‑Side Request Forgery

Tue, 29 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Title Open Redirect in Dell Secure Connect Gateway Policy Manager Enables Server‑Side Request Forgery

Tue, 29 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
Description Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.
Weaknesses CWE-601
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}

Subscriptions

Dell Policy Manager For Secure Connect Gateway Secure Connect Gateway Policy Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-09-29T13:45:50.537Z

Reserved: 2026-08-13T11:04:26.935Z

Link: CVE-2026-73599

cve-icon Vulnrichment

Updated: 2026-09-29T13:45:46.503Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-29T13:17:51.763

Modified: 2026-10-06T16:32:49.740

Link: CVE-2026-73599

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T20:30:18Z

Weaknesses
  • CWE-601

    URL Redirection to Untrusted Site ('Open Redirect')