Description

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-07T14:16:54.697Z",
  "pubdate": "2026-09-07T14:16:54.697Z",
  "executiveSummary": "Dell Secure Connect Gateway (SCG) 5.0 is susceptible to an Improper Limitation of a Pathname to a Restricted Directory vulnerability, classified as Path Traversal.\nThis flaw allows an unauthenticated remote attacker to bypass directory restrictions, potentially resulting in Remote Code Execution (RCE) on the affected appliance or application instance.\nThe vulnerability affects Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00.\nGiven the nature of the vulnerability, the risk is critical as it enables full system compromise without requiring prior authentication or user interaction.\nAttackers can leverage this vulnerability to gain unauthorized access to system files, manipulate configuration files, or inject malicious payloads to execute arbitrary code within the context of the application's service account.",
  "technicalDetails": "The root cause of this vulnerability is improper sanitization of user-supplied input when handling file system paths. The application fails to adequately restrict path navigation, allowing characters such as '..' (dot-dot-slash) to traverse outside the intended directory structure.\nAn unauthenticated attacker can exploit this by crafting malicious HTTP requests containing traversal sequences. When the application processes these requests to access or load files, it incorrectly resolves the path, effectively permitting access to unauthorized areas of the underlying file system.\nThe exploitation flow typically begins with the attacker identifying an endpoint that handles file operations or resource requests. By manipulating parameters to include directory traversal sequences, the attacker can force the application to read or write files outside of the application's defined sandbox.\nIf the attacker succeeds in gaining write access via this traversal mechanism, they may attempt to overwrite sensitive configuration files or place executable scripts within directories that are processed or executed by the system. This can lead to Remote Code Execution (RCE) when the system subsequently interprets or runs the maliciously placed or modified file.\nThe vulnerability is present in both the Dell SCG 5.0 Appliance and the Dell SCG 5.0 Application versions, indicating a flaw in the common code base utilized for file handling within the Secure Connect Gateway architecture.\nBecause the vulnerability is exploitable by an unauthenticated remote attacker, the attack surface includes any network interface that has access to the management or application interface of the Dell SCG instance.\nSuccessful exploitation grants the attacker the same privileges as the SCG service account. Depending on the environment, this could facilitate lateral movement, exfiltration of sensitive configuration data (such as credentials or tokens), and complete takeover of the SCG management functionality."
}