Description

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Not Failing Securely ('Failing Open') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-10-09T09:17:09.550Z",
  "pubdate": "2026-10-09T09:17:09.550Z",
  "executiveSummary": "Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 are susceptible to a security failure mechanism identified as 'Failing Open' (CWE-637).\nThis vulnerability exists when a protection mechanism encounters an error state and fails in a manner that allows unauthorized access rather than denying it.\nA remote, low-privileged attacker can exploit this condition to bypass intended security controls, effectively circumventing authorization or authentication policies enforced by the Policy Manager.\nThe risk implication is significant, as the vulnerability enables the bypass of security-critical logic that governs system access and operational policy, potentially leading to unauthorized administrative actions or policy manipulation within the gateway environment.\nSuccessful exploitation requires the attacker to have established remote network access to the target system. The vulnerability highlights a breakdown in robust exception handling, where the default behavior of the security component defaults to an unauthenticated or authorized state upon failure.",
  "technicalDetails": "The vulnerability resides within the Policy Manager component of the Dell Secure Connect Gateway (SCG), specifically concerning the handling of control-flow exceptions and security-gated transitions.\nThe root cause is a 'Not Failing Securely' flaw, wherein the underlying software logic fails to maintain a deny-all posture when an internal security check or policy enforcement mechanism fails due to an unhandled exception or malformed input.\nIn a secure implementation, when a security control fails to execute or reach a definitive result (Allow/Deny), the system should transition to a fail-closed state, blocking all subsequent actions. In the affected versions of SCG, the system defaults to an 'Open' state, effectively ignoring the failed policy check.\nAttack flow begins with the low-privileged attacker identifying the specific API endpoints or management functions handled by the Policy Manager. By submitting crafted requests that trigger a specific error condition—such as resource exhaustion, parsing errors, or state-machine corruption during the validation process—the attacker forces the application into an error-handling block that lacks proper security context.\nOnce the error occurs, the Policy Manager component fails to validate the request integrity or the caller's permissions, proceeding as if the request were legitimate or authorized. This bypasses the Protection mechanism entirely.\nThe exploitation allows an attacker to interact with backend management functions that would otherwise require higher privileges. Because the security state is bypassed rather than validated, the application process executes the attacker's commands with the permissions of the service-running account.\nThe post-exploitation impact includes the potential for unauthorized configuration changes, exfiltration of telemetry data, or the redirection of gateway traffic, depending on the scope of the affected Policy Manager functions.\nThe vulnerability affects all SCG Policy Manager instances identified as prior to version 5.34.00.16. There is no requirement for local access; the vulnerability is reachable over the network, providing an expanded attack surface for remote adversaries who can reach the gateway's management interface."
}