Executive brief
Dell Secure Connect Gateway is a remote access appliance and application used to secure connections to corporate networks. An unauthenticated attacker can capture and indefinitely reuse authentication requests to generate admin access tokens without any time limits or request validation, completely bypassing authentication and gaining full administrative control over the system.
Technical details
This vulnerability is an insufficient verification of data authenticity flaw in Dell SCG 5.0 Appliance (versions before 5.36.00.16) and Application (versions before 5.36.00.00). The root cause is the absence of nonce validation and time-based request expiration in the authentication mechanism. An unauthenticated attacker with network access can capture a valid authentication request and replay it repeatedly to generate ADMIN access tokens and refresh tokens indefinitely. No authentication is required for the initial exploitation, and the attack is trivial to perform. Patches are available in SCG 5.0 Appliance 5.36.00.16 and Application 5.36.00.00.
Affected products
- Dell Secure Connect Gateway 5.0 Appliance prior to 5.36.00.16
- Dell Secure Connect Gateway 5.0 Application prior to 5.36.00.00
Timeline
- 2026-09-09: disclosed