Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Dell Secure Connect Gateway 5.0 permits admin takeover

CVE-2026-80172 · published 1 month ago
Summary

Versions of the Dell Secure Connect Gateway 5.0 appliance and application before the latest updates can be tricked into accepting forged requests. This lets an unauthenticated remote attacker repeatedly gain administrator access and create new session tokens. Upgrade to the newest version as soon as possible to close the gap.

What to do
  • Update dell secure connect gateway 5.0 - application to version 5.36.00.00 or later or later.
  • Update dell secure connect gateway 5.0 - appliance to version 5.36.00.16 or later or later.
Affected software
VendorProductAffected versions
dell secure connect gateway 5.0 - application < 5.36.00.00 or later
dell secure connect gateway 5.0 - appliance < 5.36.00.16 or later
dell secure_connect_gateway < 5.36.00.00
< 5.36.00.16
cpe:2.3:a:dell:secure_connect_gateway:*:*:*:*:application:*:*:*
Original advisory text
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthent...
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access. This vulnerability is considered critical as an unauthenticated attacker can repeatedly reuse a captured request to generate ADMIN access and refresh tokens. Since there is no nonce validation or time limit on requests, the attack can be performed indefinitely. Dell recommends customers to upgrade at the earliest opportunity
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-345Insufficient Verification of Data Authenticity
Timeline
Published9 Sep 2026
Updated4 Nov 2026
First seen9 Sep 2026
Sources
CVE-2026-80172 · NVD
CVE-2026-80172 · MITRE
Track software like this
Free during beta