Dell Secure Connect Gateway Authentication Bypass via Token Replay

CVE-2026-80172 is an authentication bypass in Dell Secure Connect Gateway (SCG) 5.0 — the appliance and application that connects Dell servers, storage, and hyper-converged infrastructure back to Dell support services. Builds before 5.36.00.16 (Appliance) and 5.36.00.00 (Application) allow an unauthenticated attacker who can capture a single authentication request to replay it indefinitely to mint fresh ADMIN-level access and refresh tokens. No nonce, no timestamp check, no replay protection of any kind. The attacker gets full administrative control of the SCG console, exposing telemetry, device inventory, and configuration of every managed Dell asset.

Dell did not publish a formal CVSS vector to NVD or MITRE, but the SecurityOnline writeup cites a 9.8 score from the DSA-2026-382 advisory. A 9.8 implies Network/Low/None/Changed/High/High — classic unauthenticated-RCE territory. That overstates the real-world risk: SCG is an internal management appliance. It is not designed to face the internet, and the attack requires capturing a legitimate token-generation request first (implying some network position or prior compromise). A 7.8 HIGH better reflects the actual blast radius: devastating if you are on the same VLAN, but gated behind network access and a replay precondition.

Why this verdict

• Internal-only deployment: SCG is designed for internal management VLANs only. Dell's own deployment guide requires internal placement with outbound-only HTTPS. This eliminates the unauthenticated-remote-from-internet scenario that justifies 9.8.
• Replay precondition adds friction: The attack is not fire-and-forget. The attacker must first capture a valid authentication request, requiring either MitM position on the management network or compromise of a system that has issued such a request. This is a meaningful gate.
• No PoC, no exploitation, fresh disclosure: With only 8 days since patch release, no public PoC, no KEV listing, and no reported exploitation, the immediate threat is low. Weaponization timeline is likely weeks to months.
• Role multiplier: SCG is a management-plane appliance. In Dell-heavy data centers (which represent a significant share of enterprise compute), SCG manages the entire fleet of servers, storage arrays, and HCI nodes. Compromise exposes full asset inventory, hardware telemetry, and support-tunnel access. Combined with the sibling RCE (CVE-2026-61410) and root-escape (CVE-2026-80238) bugs in the same advisory, the chain ends in root on the SCG appliance with visibility into the entire Dell fleet. This is a management-plane pivot — the blast radius is fleet-scale in Dell-centric environments, which floors the verdict at HIGH.
• No internet exposure baseline to break the floor: Unlike network edge appliances with measurable Shodan footprints, SCG has no expected internet exposure. But the absence of internet exposure data means we cannot quantify the <1% threshold needed to break below the HIGH floor for a management-plane component.

Why not higher?

CRITICAL would require either (a) internet-facing exposure making the unauthenticated attack directly reachable, (b) active exploitation or a weaponized PoC, or (c) SCG being a canonical high-value-role component like a domain controller or hypervisor. SCG is a support/telemetry appliance — serious but not identity-tier or compute-tier. The replay precondition also adds meaningful friction absent from true CRITICAL bugs.

Why not lower?

The management-plane blast radius prevents MEDIUM. Even though the attack requires internal access and request capture, a successful exploit gives the attacker full admin over an appliance that inventories and tunnels into the entire Dell hardware fleet. The three sibling CVEs in DSA-2026-382 create a chain from token replay → RCE → root that makes post-exploitation trivial once the initial gate is passed.

1. Isolate SCG on a dedicated management VLAN with strict ACLs — If SCG is already segmented, verify that only authorized admin workstations and Dell's outbound HTTPS endpoints (port 443/8443) can reach it. This eliminates the replay vector from general internal networks. Deploy within the noisgate HIGH mitigation SLA of 30 days if not already in place.
2. Restrict SCG management port access to named jump hosts only — Limit TCP 5700/9443 access to a hardened bastion or PAM-gated jump host. This reduces the attack surface for request capture to a single, monitored chokepoint.
3. Enable TLS certificate pinning and mutual TLS where supported — If SCG supports client certificate authentication, enable it. This makes captured requests non-replayable from a different host, neutralizing the core vulnerability.
4. Monitor SCG audit logs for anomalous token generation — Alert on multiple ADMIN token issuance events within a short window, especially from unexpected source IPs. Forward SCG logs to your SIEM immediately.
5. Patch all three CVEs in DSA-2026-382 together — CVE-2026-80172, CVE-2026-61410, and CVE-2026-80238 form a chain. Patching only one leaves the others exploitable. Upgrade to Appliance 5.36.00.16 / Application 5.36.00.00 within the noisgate HIGH remediation SLA of 180 days.

Run this script on the SCG appliance itself (SSH as root) or from any Linux host with network access to the SCG API. Invoke with: bash check_scg_cve2026_80172.sh <SCG_HOSTNAME>. Requires curl and network access to the SCG management port.

#!/usr/bin/env bash
# check_scg_cve2026_80172.sh — Checks Dell SCG version against CVE-2026-80172
# Usage: bash check_scg_cve2026_80172.sh <SCG_HOSTNAME_OR_IP>
# Requires: curl, network access to SCG management interface
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

HOST="${1:-}"
if [[ -z "$HOST" ]]; then
  echo "Usage: $0 <SCG_HOSTNAME_OR_IP>"
  exit 2
fi

# Minimum safe versions
MIN_APPLIANCE="5.36.00.16"
MIN_APPLICATION="5.36.00.00"

# Try to get version from SCG API (common endpoint)
VERSION=$(curl -sk --connect-timeout 10 "https://${HOST}:5700/api/v1/version" 2>/dev/null | grep -oP '"version"\s*:\s*"\K[^"]+' || true)

if [[ -z "$VERSION" ]]; then
  # Try alternate port
  VERSION=$(curl -sk --connect-timeout 10 "https://${HOST}:9443/api/v1/version" 2>/dev/null | grep -oP '"version"\s*:\s*"\K[^"]+' || true)
fi

if [[ -z "$VERSION" ]]; then
  # Try local file check if running on the appliance
  if [[ -f /opt/dell/scg/version.txt ]]; then
    VERSION=$(cat /opt/dell/scg/version.txt | head -1 | tr -d '[:space:]')
  fi
fi

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN — Could not determine SCG version from $HOST"
  echo "Verify manually: SSH to SCG appliance and check /opt/dell/scg/version.txt"
  exit 2
fi

echo "Detected SCG version: $VERSION"

# Version comparison function
version_gte() {
  printf '%s\n%s' "$2" "$1" | sort -V -C
}

if version_gte "$VERSION" "$MIN_APPLIANCE"; then
  echo "PATCHED — SCG version $VERSION meets or exceeds $MIN_APPLIANCE"
  exit 0
else
  echo "VULNERABLE — SCG version $VERSION is below $MIN_APPLIANCE (CVE-2026-80172)"
  echo "Update to Appliance 5.36.00.16+ or Application 5.36.00.00+ immediately."
  exit 1
fi

Sources

1. SecurityOnline — CVE-2026-80172 Dell SCG Analysis
2. Dell DSA-2026-020 — SCG Security Update
3. Dell Secure Connect Gateway Product Page
4. Dell SCG Deployment Guide — Network Requirements
5. Dell SCG Security Whitepaper
6. CyberPress — Dell SCG Vulnerability Alert
7. CISA Known Exploited Vulnerabilities Catalog