CVE-2026-27101

Vulnerability

Overview

Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application versions 5.28.00.28.00.xx through 5.32.00.xx contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [1]. The CVE description confirms that a high-privileged attacker operating within the management network could exploit this flaw, potentially leading to remote code execution [1].

Attack

Scenario

The vulnerability requires the attacker to already have high privileges and network access to the management plane of the gateway uses. The CVSS v3.1 vector string (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) indicates exploitation is network-based, does not require user interaction, and has low attack complexity [1]. A successful attack may allow the adversary to bypass directory restrictions and access or write files outside the intended path. The advisory from Dell notes that the highest threat from this vulnerability is to confidentiality, integrity, and availability, each with a low impact [1].

Impact & Mitigation

A successful exploit could lead to remote execution, meaning the attacker could run arbitrary commands or code on the SCG appliance or application. This poses a risk to the management‑network risk because SCG typically handles device monitoring and configuration. Dell has released a remediated version, SCG 5.34.00.00 or later, which fixes the vulnerability. Customers should upgrade as soon as possible to prevent potential exploitation [1].