Description

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to server-side request forgery.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-07T17:17:25.083Z",
  "pubdate": "2026-09-07T17:17:25.083Z",
  "executiveSummary": "Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application editions contain a vulnerability involving improper certificate validation. This flaw allows a locally authenticated, low-privileged attacker to perform Server-Side Request Forgery (SSRF).\nThe vulnerability stems from the application's failure to verify the authenticity of SSL/TLS certificates when initiating outbound requests. By exploiting this, an attacker can manipulate the appliance to send requests to arbitrary internal or external destinations on the attacker's behalf.\nThis impacts the integrity of the appliance’s network communications, potentially bypassing firewall rules or accessing sensitive internal services that are otherwise unreachable by the attacker. Successful exploitation requires the attacker to possess local access to the system, limiting the attack surface to authenticated users within the host environment. The risk is significant as it facilitates unauthorized interaction with internal infrastructure, potentially leading to further reconnaissance or compromise of connected services within the Dell SCG ecosystem.",
  "technicalDetails": "The vulnerability is categorized as an Improper Certificate Validation issue, which occurs when a software component fails to properly verify the validity, chain of trust, or hostname of a remote server's X.509 certificate during a TLS/SSL handshake. In the context of Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, the application acts as a client initiating requests to external or internal endpoints.\nThe root cause resides in the lack of robust certificate pinning or validation logic during the execution of server-side requests. When the SCG component attempts to establish a secure connection, it fails to enforce cryptographic validation of the peer's identity. This oversight allows an attacker to intercept or redirect outgoing traffic or, more effectively, to force the appliance to interact with malicious or unintended endpoints that present arbitrary or self-signed certificates.\nThe attack flow proceeds as follows: First, an attacker with low-privileged local access interacts with the SCG management interface or underlying service APIs to trigger an outbound request mechanism—often related to system updates, telemetry reporting, or diagnostic communications. By injecting a crafted request (such as a modified URL or a redirected target endpoint), the attacker forces the application to initiate a connection to a resource under the attacker's control or an internal service (SSRF). Because the application skips certificate verification, it will establish the connection regardless of the server's identity, effectively ignoring standard TLS security controls.\nThe exploitation allows for SSRF, where the appliance acts as a proxy or an unintended sender of traffic. An attacker could probe internal network services that require the appliance's credentials or utilize the appliance's network context to bypass network access control lists (ACLs). Since the application processes these requests with the service's own permissions, the post-exploitation impact includes the potential to exfiltrate sensitive data or interact with internal administrative interfaces that would normally reject external connections. The vulnerability does not require administrative privileges, merely local access to the SCG environment, significantly lowering the barrier for lateral movement or exploitation of peripheral internal systems."
}