Description
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to server-side request forgery.
Published: 2026-09-07
Score: 5.5 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an improper certificate validation flaw in Dell Secure Connect Gateway 5.0 Appliance and Application. A low‑privileged attacker with local access can bypass TLS server‑certificate checks, allowing the gateway to send arbitrary requests to internal services and thereby perform server‑side request forgery. This flaw is classified as CWE‑295.

Affected Systems

Affected are Dell Secure Connect Gateway 5.0 Appliance versions earlier than 5.36.00.16 and Dell Secure Connect Gateway 5.0 Application versions earlier than 5.36.00.00. These versions are found in virtual or appliance deployments used for secure remote access.

Risk and Exploitability

The CVSS assessment rates this vulnerability as 5.5, indicating moderate severity. No EPSS score is publicly available, and the flaw is not listed in the CISA KEV catalog. The exploit requires local, low‑privileged access; the attacker leverages the certificate‑validation bypass to forge internal requests. While remote exploitation is not feasible, organizations permitting local account usage without strict controls are at risk.

Generated by OpenCVE AI on September 7, 2026 at 17:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Dell security update that patches the certificate‑validation flaw, upgrading Appliance versions to 5.36.00.16 or newer and Application versions to 5.36.00.00 or newer.
  • Limit local access to the SCG appliance by enforcing least‑privilege user accounts and disabling unused local accounts.
  • As a temporary measure, disable external outbound connections that rely on certificate validation until the update is applied, and monitor for abnormal outbound traffic patterns.

Generated by OpenCVE AI on September 7, 2026 at 17:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 07 Sep 2026 18:00:00 +0000

Type Values Removed Values Added
Title Improper Certificate Validation Enabling SSRF in Dell Secure Connect Gateway 5.0

Mon, 07 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to server-side request forgery.
Weaknesses CWE-295
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-09-07T16:08:45.796Z

Reserved: 2026-08-25T16:04:25.342Z

Link: CVE-2026-79975

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-07T17:17:25.083

Modified: 2026-09-07T17:17:25.083

Link: CVE-2026-79975

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T17:45:17Z

Weaknesses
  • CWE-295

    Improper Certificate Validation