Description

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Relative Path Traversal vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to remote execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-07T14:16:54.813Z",
  "pubdate": "2026-09-07T14:16:54.813Z",
  "executiveSummary": "Dell Secure Connect Gateway (SCG) 5.0 is susceptible to a critical relative path traversal vulnerability, categorized as an improper limitation of a pathname to a restricted directory. This security flaw enables a remote, low-privileged attacker to bypass directory restrictions, potentially facilitating remote code execution (RCE) on the underlying system. The vulnerability affects both the Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and the Dell SCG 5.0 Application versions prior to 5.36.00.00.\nThe risk implication is severe, as the compromise of the appliance may allow an unauthorized actor to gain elevated privileges, execute arbitrary commands, and compromise the integrity and confidentiality of the host environment. Exploitation requires remote network access, but does not necessitate high-level administrative credentials, significantly lowering the barrier for entry for malicious actors. Remediation necessitates immediate upgrading to the vendor-specified secure versions to neutralize the attack vector.",
  "technicalDetails": "The vulnerability resides in the input validation mechanisms of the Dell Secure Connect Gateway (SCG) 5.0, where insufficient sanitization of user-supplied input allows for the inclusion of directory traversal sequences (e.g., ../). By manipulating file path parameters in HTTP requests, an attacker can escape the intended web application root directory to access or overwrite sensitive system files outside of the defined application scope.\nThe root cause is identified as an Improper Limitation of a Pathname to a Restricted Directory (CWE-22). The application fails to properly neutralize special characters and path traversal sequences during file processing operations. This flaw allows the attacker to traverse the file system hierarchy, reaching critical configuration files, scripts, or execution binaries that should remain protected from low-privileged users.\nThe attack flow initiates with a remote, low-privileged attacker identifying an vulnerable endpoint that accepts file paths as input. By injecting traversal sequences, the attacker directs the application to interact with unintended file paths. If the application processes these inputs with higher system privileges, the attacker can overwrite executable binaries or configuration files with malicious payloads. Subsequently, by triggering the execution of these modified components, the attacker achieves remote code execution.\nThis vulnerability is particularly critical because it bypasses standard access control mechanisms. Because the service may be running with elevated permissions, the successful exploitation permits the execution of arbitrary commands under the security context of the appliance or application service account. The post-exploitation impact includes full system compromise, potential data exfiltration, lateral movement within the management network, and persistent unauthorized access.\nAffected versions include Dell SCG 5.0 Appliance versions before 5.36.00.16 and Dell SCG 5.0 Application versions before 5.36.00.00. There are no indications that specialized physical access is required, as the exploit is deliverable over the network, making it a high-risk remote attack vector."
}