CVE-2026-80172 in Secure Connect Gateway
Summary
by MITRE • 09/09/2026
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access. This vulnerability is considered critical as an unauthenticated attacker can repeatedly reuse a captured request to generate ADMIN access and refresh tokens. Since there is no nonce validation or time limit on requests, the attack can be performed indefinitely. Dell recommends customers to upgrade at the earliest opportunity
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The identified security flaw resides within Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and the corresponding Application versions prior to 5.36.00.00, representing a critical failure in authentication protocol implementation. This vulnerability is classified as an Insufficient Verification of Data Authenticity issue, which fundamentally undermines the integrity of the access control mechanisms governing administrative privileges. The core technical deficiency lies in the absence of robust replay protection measures within the request validation logic. Specifically, the system fails to implement nonce validation or enforce strict time limits on authentication requests. In a secure implementation, each authentication token or session identifier should be unique and bound to a specific timeframe to prevent reuse. However, due to this omission, any captured network packet containing valid administrative credentials can be replayed indefinitely without detection by the target application.
From an operational perspective, this architectural weakness allows for severe unauthorized access scenarios involving unauthenticated attackers who possess remote connectivity to the affected systems. An adversary capable of intercepting traffic through man-in-the-middle attacks or other network eavesdropping techniques can capture legitimate administrative requests. Because there is no mechanism to invalidate these captured tokens after their initial use, the attacker can repeatedly reuse them to generate new ADMIN access and refresh tokens. This capability effectively bypasses standard authentication controls, granting the attacker persistent elevated privileges within the management interface. The lack of expiration policies means that even if credentials are rotated or passwords changed, previously captured valid requests may still function until they are manually invalidated through other administrative actions, creating a significant window of exposure for malicious exploitation.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-287, which describes Improper Authentication, and specifically relates to the failure to verify data authenticity during access control processes. In terms of adversary tactics, this flaw facilitates techniques associated with MITRE ATT&CK ID T1078, Valid Accounts, as it allows attackers to maintain persistent access using stolen or replayed credentials without needing to crack passwords or exploit additional software bugs. The ability to generate refresh tokens indefinitely exacerbates the risk by enabling long-term persistence within the environment. Attackers can leverage these refreshed tokens to bypass session timeouts and continue accessing sensitive management functions even after initial sessions have theoretically expired, thereby complicating incident response efforts that rely on token revocation as a primary mitigation strategy during an active breach.
To mitigate this critical vulnerability, immediate action is required by upgrading all affected Dell SCG 5.0 Appliance instances to version 5.36.00.16 or later and ensuring the Application component is updated to version 5.36.00.00 or higher. These updates incorporate necessary cryptographic improvements that enforce nonce validation and implement strict time-based expiration for authentication requests, thereby neutralizing replay attacks. In addition to patching, organizations should review network segmentation strategies to limit remote access to management interfaces where possible. Implementing multi-factor authentication adds an additional layer of security that can mitigate the impact of stolen tokens by requiring a second factor independent of the captured request data. Regular monitoring for anomalous login patterns and token usage frequencies can also help detect potential exploitation attempts before significant damage occurs, ensuring the integrity of administrative controls remains intact against sophisticated replay-based attacks.