Description

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Filesystem access for attacker.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-10-09T10:16:39.253Z",
  "pubdate": "2026-10-09T10:16:39.253Z",
  "executiveSummary": "Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 are susceptible to an improper limitation of a pathname to a restricted directory, classified as a Path Traversal vulnerability.\nThis security flaw allows a locally authenticated attacker with high privileges to manipulate file paths, potentially resulting in unauthorized filesystem access and the execution of arbitrary code.\nThe vulnerability resides within the Policy Manager component of the Dell Secure Connect Gateway architecture.\nSuccessful exploitation poses a critical risk to system integrity and confidentiality, as it enables the bypass of intended directory restrictions to interact with files outside of the application's secure scope.\nThe attack vector requires prior local access to the system and high-level administrative or elevated privileges, limiting the scope to internal actors or compromised high-privileged sessions.\nOrganizations using affected versions of Dell SCG are at risk of complete system compromise if the vulnerability is leveraged to inject or execute malicious binaries via the traversal mechanism.",
  "technicalDetails": "The vulnerability is identified as a Path Traversal issue within the Dell Secure Connect Gateway (SCG) Policy Manager. The root cause lies in the insufficient sanitization or validation of user-supplied input when constructing file system paths, enabling the use of directory traversal sequences (e.g., '../') to escape designated application directories.\nThis flaw specifically affects the Policy Manager component, which is responsible for enforcing security policies within the gateway. By providing specially crafted input to an interface handled by the Policy Manager, an attacker can manipulate the path resolution logic to access sensitive configuration files, system binaries, or data stores that reside outside of the restricted operational environment.\nThe exploitation process typically involves an attacker with high-level local access manipulating the input parameters processed by the vulnerable component. By traversing to sensitive system directories, the attacker can overwrite critical system files or upload malicious scripts to executable paths. Given the high privilege level of the application, once the file system access is achieved, the attacker can replace existing binaries or configuration files that are subsequently executed or loaded by the SCG service, leading to arbitrary code execution with elevated system permissions.\nThe attack flow follows these steps: 1) The attacker authenticates locally with high privileges. 2) The attacker submits a malicious request to the Policy Manager containing directory traversal sequences. 3) The backend application fails to validate these sequences, allowing the file handler to resolve paths outside the intended directory. 4) The attacker gains read/write access to sensitive portions of the filesystem. 5) By writing to a known executable path or configuration file, the attacker achieves remote or local code execution, effectively hijacking the process flow of the SCG software.\nAffected versions include all releases of Dell Secure Connect Gateway Policy Manager prior to 5.34.00.16. The impact is severe, as the compromise of a security gateway often grants an attacker visibility into or control over the managed environment's connectivity and security posture. Post-exploitation, the attacker maintains a persistent foothold, as the changes made to the filesystem can survive standard service restarts if critical startup files are targeted."
}