CVE-2026-79970: CWE-347: Improper Verification of Cryptographic Signature in Dell Secure Connect Gateway 5.0 - Application
Affects Dell Secure Connect Gateway 5.0 - ApplicationSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:LWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| DellSecure Connect Gateway 5.0 - Application | Affected
| Fixed in
|
| DellSecure Connect Gateway 5.0 - Appliance | Affected
| Fixed in
|
AI-suggested
Until a fix is available, consider restricting remote access to the affected Dell SCG 5.0 components to trusted networks only.
Description
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Verification of Cryptographic Signature vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass.
Impact
The vulnerability allows an unauthenticated remote attacker to potentially bypass cryptographic signature verification protections, which could lead to unauthorized actions or compromise of system integrity. The impact is rated medium with low confidentiality, integrity, and availability impacts according to the CVSS vector.
Summary
CVE-2026-79970 describes an improper verification of cryptographic signature vulnerability (CWE-347) in Dell Secure Connect Gateway 5.0 Appliance and Application. Versions prior to 5.36.00.16 (appliance) and 5.36.00.00 (application) are affected. An unauthenticated attacker with remote access could exploit this flaw to bypass security protections. The CVSS 3.1 base score is 5.6, indicating medium severity, with attack vector network, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability at a low level. No vendor advisory or patch information is provided, and no known exploits in the wild have been reported.