CVE-2026-80169: CWE-532: Insertion of Sensitive Information into Log File in Dell Secure Connect Gateway 5.0 - Application
Affects Dell Secure Connect Gateway 5.0 - ApplicationSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 2% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| DellSecure Connect Gateway 5.0 - Application | Affected
| Fixed in
|
| DellSecure Connect Gateway 5.0 - Appliance | Affected
| Fixed in
|
AI-suggested
Until an official fix is released, restrict local access to trusted users only and monitor for any suspicious activity related to log file access. Avoid exposing sensitive information in logs where possible through configuration changes if supported.
Description
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.
Impact
The vulnerability allows a low privileged local attacker to cause sensitive information to be written into log files, potentially exposing confidential data. The impact is limited to confidentiality with no effect on integrity or availability. Exploitation requires local access and low complexity, but the overall severity is low.
Summary
CVE-2026-80169 describes an insertion of sensitive information into log files vulnerability (CWE-532) affecting Dell Secure Connect Gateway 5.0 Appliance versions prior to 5.36.00.16 and Application versions prior to 5.36.00.00. A low privileged attacker with local access could exploit this vulnerability to gain access to sensitive information stored in log files. The CVSS 3.1 base score is 3.3, reflecting low confidentiality impact and no impact on integrity or availability. No vendor advisory or patch information is currently available, and the vulnerability is not known to be exploited in the wild.