Description

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Relative Path Traversal vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-09-07T13:20:38.800Z",
  "pubdate": "2026-09-07T13:20:38.800Z",
  "executiveSummary": "Dell Secure Connect Gateway (SCG) 5.0 is susceptible to a Relative Path Traversal vulnerability, classified as a critical security flaw.\nThis vulnerability allows an unauthenticated remote attacker to traverse the file system, potentially resulting in Remote Code Execution (RCE) on the underlying appliance or application.\nThe vulnerability affects Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00.\nBy manipulating input vectors that fail to sanitize file path sequences, an attacker can bypass security controls to read, write, or execute arbitrary files.\nThe risk implication is severe, as successful exploitation grants the attacker the ability to execute unauthorized code with the privileges of the application service, potentially leading to a full system compromise.\nThe attack does not require prior authentication, making it particularly dangerous for internet-facing instances or those within internal networks accessible to unauthorized users.",
  "technicalDetails": "The vulnerability resides in the input validation logic of the Dell SCG 5.0 platform, specifically in how the application processes file path requests. The root cause is the insufficient sanitization of user-supplied input containing directory traversal sequences, such as '../' (dot-dot-slash) characters.\nWhen the application processes a request involving a file path, it fails to correctly resolve or restrict the path to the intended directory. An unauthenticated attacker can leverage this flaw by injecting crafted path sequences into the request parameters. By traversing outside the designated application directory, the attacker can access sensitive configuration files, system binaries, or web-accessible directories.\nThe exploitation flow typically begins with an attacker identifying a vulnerable endpoint within the Dell SCG interface that accepts file-related input. The attacker crafts a request, often via a GET or POST method, incorporating directory traversal strings to target specific files. If the server-side process executes operations on the path resolved through the malicious input without proper boundary checks, the attacker may gain the ability to write arbitrary content to sensitive locations or invoke execution of existing system scripts.\nIn scenarios where the application facilitates file uploads or execution, the path traversal can be chained with other techniques to achieve RCE. By overwriting configuration files or placing executable payloads in accessible paths, the attacker triggers the execution of unauthorized commands. The vulnerability operates within the context of the service account under which the SCG application is running, which often possesses elevated privileges necessary for gateway operations.\nBecause the attack vector is accessible without authentication, it bypasses standard session-based security controls. The exploitation is remote, meaning the attacker does not need local access to the appliance. The impact is significant as it provides a pathway for complete system takeover, lateral movement within the network, or the exfiltration of sensitive telemetry data handled by the Secure Connect Gateway."
}