CVE-2026-80172: Critical severity Dell SCG 5.0 Appliance vulnerability
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access. This vulnerability is considered critical as an unauthenticated attacker can repeatedly reuse a captured request to generate ADMIN access and refresh tokens. Since there is no nonce validation or time limit on requests, the attack can be performed indefinitely. Dell recommends customers to upgrade at the earliest opportunity
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dell SCG 5.0 Applianceto a version that resolves this vulnerability.Fixed in 5.36.00.16 - Upgrade
Upgrade
Dell SCG 5.0 Applicationto a version that resolves this vulnerability.Fixed in 5.36.00.00
Event History
Frequently Asked Questions
Which deployments are affected?
Dell SCG 5.0 Appliance versions earlier than 5.36.00.16 and Dell SCG 5.0 Application versions earlier than 5.36.00.00 are affected.
What does an attacker need to exploit this issue?
An attacker needs remote access to the vulnerable Dell SCG deployment and does not need authentication or user interaction. The attack relies on reusing a captured request.
What access can exploitation provide?
A successful attacker can generate ADMIN access and refresh tokens, resulting in unauthorized access.
Can a captured request be reused after a limited period?
No. The affected requests have no nonce validation or time limit, so a captured request can be reused indefinitely.
What is the recommended remediation?
Upgrade Dell SCG 5.0 Appliance to version 5.36.00.16 or later, or Dell SCG 5.0 Application to version 5.36.00.00 or later. Dell recommends upgrading at the earliest opportunity.