Dell just disclosed three critical vulnerabilities in Secure Connect Gateway (SCG) 5.0 — the appliance that bridges Dell hardware to Dell's own diagnostics and support pipeline. On their own, each is bad. Chained, they're a textbook zero-to-root attack path:
CVE-2026-80172 (CVSS 9.8) — No nonce or time-limit validation on requests. Capture one valid request, replay it indefinitely, forge admin + refresh tokens. Zero credentials needed.
CVE-2026-61410 (CVSS 9.4) — Missing authorization check lets an unauthenticated attacker send a crafted request straight into remote command execution on the host.
CVE-2026-80238 (CVSS 9.3) — An exposed Docker socket. Local or SSH-level access escalates to root, and a compromised orchestrator service opens the door to container escape.
Stack those three and you get: no creds → forged admin tokens → RCE → root. On a system that sits with legitimate visibility into your production infrastructure.
Patched versions:
- SCG 5.0 Appliance ≥ 5.36.00.16
- SCG 5.0 Application ≥ 5.36.00.00
No confirmed active exploitation yet, but a 9.8 CVSS on an unauthenticated, zero-interaction bug is exactly the profile that gets weaponized fast once researchers start poking at the advisory.
Full writeup with the realistic attack sequence, SOC-side log indicators to hunt for, and a remediation checklist that goes beyond "just patch it":
https://www.xpert4cyber.com/2026/09/dell-secure-connect-gateway-vulnerability.html
Top comments (0)