Description
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to server-side request forgery.
Published: 2026-09-07
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Server‑Side Request Forgery via Certificate Validation Bypass
Action: Patch Deployment
AI Analysis

Impact

The vulnerability is an improper certificate validation flaw in Dell Secure Connect Gateway 5.0 Appliance and Application. A low‑privileged attacker with local access can bypass TLS server‑certificate checks, allowing the gateway to send arbitrary requests to internal services and thereby perform server‑side request forgery. This flaw is classified as CWE‑295.

Affected Systems

Affected are Dell Secure Connect Gateway 5.0 Appliance versions earlier than 5.36.00.16 and Dell Secure Connect Gateway 5.0 Application versions earlier than 5.36.00.00. These versions are found in virtual or appliance deployments used for secure remote access.

Risk and Exploitability

The CVSS assessment rates this vulnerability as 5.5, indicating moderate severity. No EPSS score is publicly available, and the flaw is not listed in the CISA KEV catalog. The exploit requires local, low‑privileged access; the attacker leverages the certificate‑validation bypass to forge internal requests. While remote exploitation is not feasible, organizations permitting local account usage without strict controls are at risk.

Generated by OpenCVE AI on September 7, 2026 at 17:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Dell security update that patches the certificate‑validation flaw, upgrading Appliance versions to 5.36.00.16 or newer and Application versions to 5.36.00.00 or newer.
  • Limit local access to the SCG appliance by enforcing least‑privilege user accounts and disabling unused local accounts.
  • As a temporary measure, disable external outbound connections that rely on certificate validation until the update is applied, and monitor for abnormal outbound traffic patterns.

Generated by OpenCVE AI on September 7, 2026 at 17:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 16 Sep 2026 01:30:00 +0000

Type Values Removed Values Added
First Time appeared Dell secure Connect Gateway
CPEs cpe:2.3:a:dell:secure_connect_gateway:*:*:*:*:application:*:*:*
cpe:2.3:a:dell:secure_connect_gateway:*:*:*:*:virtual:*:*:*
Vendors & Products Dell secure Connect Gateway

Tue, 08 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Dell
Dell secure Connect Gateway Appliance
Dell secure Connect Gateway Application
Vendors & Products Dell
Dell secure Connect Gateway Appliance
Dell secure Connect Gateway Application

Tue, 08 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 07 Sep 2026 18:00:00 +0000

Type Values Removed Values Added
Title Improper Certificate Validation Enabling SSRF in Dell Secure Connect Gateway 5.0

Mon, 07 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to server-side request forgery.
Weaknesses CWE-295
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Dell Secure Connect Gateway Secure Connect Gateway Appliance Secure Connect Gateway Application
cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-09-08T12:45:12.082Z

Reserved: 2026-08-25T16:04:25.342Z

Link: CVE-2026-79975

cve-icon Vulnrichment

Updated: 2026-09-08T12:45:07.827Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-07T17:17:25.083

Modified: 2026-09-16T01:14:01.997

Link: CVE-2026-79975

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-08T20:30:17Z

Weaknesses
  • CWE-295

    Improper Certificate Validation